ESXiArgs: The code behind the ransomware

**Executive Summary:** This report presents a technical deep-dive into an ESXi-focused ransomware sample that drops a public.pem, uses an encrypt.sh shell script to enumerate VMFS volumes and locate VM files (VMDK, VMX, VMXF, VMSD, VMSN, VSQP, VMSS, NVRAM), launches concurrent encrypt processes, and runs an ELF encryptor which generates a random 32-byte key, RSA-encrypts that key, then encrypts file contents in 1MB+ chunks using the SOSEMANUK stream cipher; ransom notes are placed by overwriting VMware index.html and the system MOTD.