Videos
Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.
- Distribution Method : Unknown
- MD5 : a75ab387db577944d74d7102142f7231
- Major Detection Name : Win32/Filecoder.Ouroboros.A (ESET), Ransom_Genasom.R020C0DGA18 (Trend Micro)
- Encrypted File Pattern : <Original Filename>.king_ouroboros.<Original Extension>
- Malicious File Creation Location :
- C:\Program Files (x86)\Common Files\log.txt
- C:\Users\%UserName%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\setup.exe
- Payment Instruction File : README!!! ALL YOUR FILES HAVE BEEN SECURELY ENCRYPTED!!!.txt
- Major Characteristics :
- Offline Encryption
- Disable system restore (vssadmin.exe Delete Shadows /All /Quiet, bcdedit /set {default} recoveryenabled No, bcdedit /set {default} bootstatuspolicy ignoreallfailures)
- After completion of encryption, windows reboots automatically (shutdown -r -f -t 5)
- Disable and Blocks Task Manager (DisableTaskMgr)
- Display a ransomware message on the Windows logon screen
- Changes desktop background (C:\Program Files\Common Files\wallpaper.jpg)