Videos
Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.
- Distribution Method : Unknown
- MD5 : bd147b389bf06878eafd2eec35d99887
- Major Detection Name : Trojan.Ransom.KingOuroboros (ALYac), Win32/Filecoder.KingOuroboros.A (ESET)
- Encrypted File Pattern : <Original Filename>.king_ouroboros.<Original Extension>
- Malicious File Creation Location :
- C:\Program Files (x86)\Common Files\log.txt
- C:\Users\%UserName%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\setup.exe
- Payment Instruction File : README!!! ALL YOUR FILES HAVE BEEN SECURELY ENCRYPTED!!!.txt
- Major Characteristics :
- Offline Encryption
- Disable system restore (vssadmin.exe Delete Shadows /All /Quiet, bcdedit /set {default} recoveryenabled No, bcdedit /set {default} bootstatuspolicy ignoreallfailures)
- Disable and Blocks Task Manager (DisableTaskMgr)
- After completion of encryption, windows reboots automatically (shutdown -r -f -t 8)
- Display a ransomware message on the Windows logon screen
- Changes desktop background (C:\Program Files (x86)\Common Files\wallpaper.jpg)