Malware
Payload
According to 0x3oBAD, this is a 64-bit Linux ELF ransomware binary targeting VMware ESXi hypervisor environments.
Payload is a Linux malware family.
Background
As described by 0x3oBAD, this is a 64-bit Linux ELF ransomware binary aimed at VMware ESXi hypervisor environments. The sample pairs a solid cryptographic design (Curve25519 ECDH and ChaCha20) with ESXi-specific virtual machine enumeration through the vmInventory.xml inventory file, an orderly shutdown of running VMs prior to encryption, and a multi-threaded encryption pipeline that scales to the number of available CPU cores. Its ransom note is planted inside ESXi's own web UI welcome.txt, taking the place of the host management interface's greeting.
Source: Malpedia (Fraunhofer FKIE).