Videos
Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.
- Distribution Method : Unknown
- MD5 : 0ab599f33502425b3fe6b8ee750b435d
- Major Detection Name : a variant of Win32/GenKryptik.EKFS (ESET), Trojan:Win32/Wacatac.D!ml (Microsoft)
- Encrypted File Pattern : .g8R4rqWIp9
- Malicious File Creation Location :
- C:\Users\%UserName%\AppData\Roaming\svhosst.exe
- C:\ProgramData\ErrorResponder\<Random>.exe
- Payment Instruction File : readme.txt
- Major Characteristics :
- Offline Encryption
- Embrace / PainLocker Ransomware series
- Block processes execution (fdlauncher.exe, MsDtsSrvr.exe, msmdsrv.exe, postgres.exe, sqlbrowser.exe, sqlwriter.exe etc.)
- Stop multi services (MSSQL, MSSQLFDLauncher, SQLSERVERAGENT, TmFilter, vmickvpexchange, WRSVC etc.)
- Disable system restore (vssadmin delete shadows /all /quiet)