Videos

Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.

  • Distribution Method : Unknown
 
  • MD5 : 443670682e32a91777b1b0af2d09163d
 
  • Major Detection Name : a variant of MSIL/Filecoder.QU (ESET), Ransom.Win32.GORGON.THOABHAI (Trend Micro)
 
  • Encrypted File Pattern : .[buy-decryptor@pm.me]
 
  • Payment Instruction File : #DECRYPT MY FILES#.HTML / #내 파일 복구하기#.HTML / #解密我的文件#.HTML
 
  • Major Characteristics :
     - Offline Encryption
     - FilesLocker Ransomware series
     - The Chinese, English and Korean users targeted
     - Encryption guide using Text-to-Speech (TTS) function
     - Disable system restore (vssadmin.exe delete shadows /all /quiet)
     - Display a ransomware message on the Windows logon screen
     - Changes desktop background (C:\Users\%UserName%\Desktop\WALLPAPER.BMP)

List

위로