Videos
Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.
- Distribution Method : Unknown
- MD5 : 9353a3fa46ce13ea133cfab51c8cbd7a
- Major Detection Name : TR/AD.MedusaRansom.yvkui (Avira), a variant of Win32/Filecoder.MedusaLocker.C (ESET)
- Encrypted File Pattern : .deadfiles
- Malicious File Creation Location : C:\Users\%UserName%\AppData\Roaming\svhost.exe
- Payment Instruction File : Recovery_Instructions.html
- Major Characteristics :
- Offline Encryption
- EFI System Partition (X:\) and Recovery Partition (Y:\) drives are activate.
- Turns off User Access Control (UAC)
- Block processes execution (360se.exe, axlbridge.exe, Defwatch.exe, MsDtSrvr.exe, RAgui.exe, sqlservr.exe etc.)
- Delete multi services (ccEvtMgr, Culserver, msmdsrv, QBIDPService, sqladhlp, sqlagent etc.)
- Disable system restore (vssadmin.exe Delete Shadows /All /Quiet, bcdedit.exe /set {default} recoveryenabled No, bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures, wbadmin DELETE SYSTEMSTATEBACKUP, wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest, wmic.exe SHADOWCOPY /nointeractive)
- Adds svhost to scheduler to execute "%AppData%\svhost.exe" Every 15 minutes.