Videos

Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.

  • Distribution Method : Unknown
 
  • MD5 : eca1919c32c5bd77b16986f727f181ce
 
  • Major Detection Name : Malware/Win32.Ransom.C4312592 (AhnLab V3), Ransom.Loren (Norton)
 
  • Encrypted File Pattern : .Lorenz.sz40
 
  • Malicious File Creation Location :
     - C:\Users\%UserName%\AppData\Local\Temp\MoUsoCoreWorker.exe
     - C:\Windows\System32\Tasks\sz401
     - C:\Windows\System32\Tasks\sz402
     - C:\Windows\System32\Tasks\voise
     - C:\Windows\tWjdf.js
 
  • Payment Instruction File : HELP_SECURITY_EVENT.html
 
  • Major Characteristics :
     - Offline Encryption
     - ThunderCrypt Ransomware series
     - Adds sz401 to scheduler to execute "\\<URL>\NETLOGON\ScreenConn.exe" at user login
     - Adds sz402 to scheduler to execute "\\<URL>\NETLOGON\MSI_Install\ScreenConn.exe" at user login
     - Adds voise to scheduler to execute "\\<URL>\NETLOGON\MSI_Install\ScreenConn.exe" at a specific time every day
     - Encryption guide using Text-to-Speech (TTS) function

List

위로