Gopher Ransomware (<Original Filename>.<Original Extension> → <Base64>.NASAcry / HELP-ME-RESTORE-MY-FILES-BACK.html) - Videos - CheckMAL

Videos

Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.

Distribution Method : Unknown

MD5 : d467c7c58dd9aa0f13d6d2060eded5ca

Major Detection Name : Generic.Ransom.Snatch.67508646 (BitDefender), Ransom.MauriGo (Malwarebytes)

Encrypted File Pattern : <Original Filename>.<Original Extension> → <Base64>.NASAcry

Malicious File Creation Location : C:\Users\%UserName%\Desktop\FILES_ENCRYPTED.html

Payment Instruction File : HELP-ME-RESTORE-MY-FILES-BACK.html

Major Characteristics :
- Offline Encryption
- Disable system restore (wmic.exe shadowcopy delete, vssadmin.exe delete shadows /All /Quiet, bcedit /set {default} recoveryenabled No, bcedit /set {default} bootstatuspolicy ignoreallfailures, wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0, wmic SHADOWCOPY DELETE, vssadmin delete shadows /All)