Videos

Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.

  • Distribution Method : Unknown
 
  • MD5 : a2113ba837c7bbfa3316e0fffd5b8185
 
  • Major Detection Name : Ransom.XiaoBa (Malwarebytes), Ransom_XIAOBA.D (Trend Micro)
 
  • Encrypted File Pattern : <Original Filename>.ｲ｡ﾃ訷ﾏ摂､ﾇ､ｹ[BaYuCheng@yeah.net].XiaoBa
 
  • Malicious File Creation Location :
     - C:\Users\%UserName%\AppData\Local\Temp\XiaoBa.bmp
     - C:\Users\%UserName%\AppData\Local\Temp\XiaoBa.mp3
 
  • Major Characteristics :
     - Offline Encryption
     - The Japanese and Chinese users targeted
     - Disable system restore (vssadmin delete shadow /all /quiet, wmic shadowcopy delete, bcdedit /set {default} boostatuspolicy ignoreallfailures, bcdedit /set {default} recoveryenabled no, wbadmin delete catalog -quiet)
     - Playing Japanese music (病名は愛だった, C:\Users\%UserName%\AppData\Local\Temp\XiaoBa.mp3)
     - Changes desktop background (C:\Windows\ﾗﾀﾃ豎ｳｾｰﾍｼﾆｬ.bmp)
     - Automatically deletes encrypted files after 200 seconds of time limit message.

List

위로