Videos
Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.
- Distribution Method : Unknown
- MD5 : 96e08acb68b81da0bf4985eae10ebde2
- Major Detection Name : Ransom.Yatron (Malwarebytes), Ransom:Win32/Yatron.SA (Microsoft)
- Encrypted File Pattern : .Yatron
- Payment Instruction File : Read@My.txt
- Major Characteristics :
- Offline Encryption
- Hidden-Tear open source based ransomware
- Block processes execution (ProcessHacker, procexp, vmware, wireshark etc.)
- Disable system restore (vssadmin.exe delete shadows /all /quiet, wmic.exe shadowcopy delete, bcdedit /set {default} bootstatuspolicy ignoreallfailures, bcdedit /set {default} recoveryenabled no, wbadmin delete catalog -quiet)
- Network propagation function using EternalBlue SMB vulnerability (DoublePulsar + EternalBlue)
- Includes ability of propagate through P2P Sharing applications (BearShare, eMule, Kazaa etc.)