Videos

Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.

  • Distribution Method : Unknown
 
  • MD5 : e4e2aa6df9a5ca1e7942472a13bcd79d
 
  • Major Detection Name : Trojan-Ransom.Win32.Matrix.te (Kaspersky), Ransom-Matrix.a (McAfee)
 
  • Encrypted File Pattern : <Original Filename>_Write_To_Emails_[Jingju87@naver.com][Loder903@gmail.com].<Original Extension>
 
  • Malicious File Creation Location :
     - C:\Users\%UserName%\AppData\Roaming\<Random>.cmd
     - C:\Users\%UserName%\AppData\Roaming\<Random>.vbs
 
  • Payment Instruction File : Read_Me_T0_Rest0re_Files.rtf / Read_Me_T0_Rest0re_Files1.rtf ~ Read_Me_T0_Rest0re_Files50.rtf
 
  • Major Characteristics :
     - Offline Encryption
     - Change the default values of the registry entry "HKEY_CLASSES_ROOT\mscfile\shell\open\command" and disable system restore (vssadmin.exe delete shadows /all /quiet) using Event Viewer (eventvwr.exe)
     - Interrupt file recovery using cipher.exe /w:<Drive Letter>
     - Changes desktop background (C:\Users\%UserName%\AppData\Roaming\<Random>.jpg)

List

위로