Videos
Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.
- Distribution Method : Unknown
- MD5 : da0706781bb91736569aa33203b4e4ea
- Major Detection Name : Ransomware/Win.LockBit.R503945 (AhnLab V3), Trojan:Win32/Lockbit.HA!MTB (Microsoft)
- Encrypted File Pattern : <Random Filename>.hVGakg14U
- Malicious File Creation Location :
- C:\ProgramData\<Random>.tmp
- C:\ProgramData\hVGakg14U.ico
- Payment Instruction File : hVGakg14U.README.txt
- Major Characteristics :
- Offline Encryption
- Block processes execution (dbsnmp, mydesktopqos, oracle, outlook, synctime, xfssvccon etc.)
- Stop multi services (Browser, Dhcp, gpsvc, HomeGroupProvider, MMCSS, Wcmsvc etc.)
- Delete multi services (EventLog, vmicvss, VSS, WdFilter, WinDefend, wscsvc etc.)
- Changes desktop background (C:\ProgramData\hVGakg14U.bmp)
- Interrupt file recovery using "C:\ProgramData\<Random>.tmp"
- Empty the trash
- Change encrypted file (.hVGakg14U) icon (HKEY_CLASSES_ROOT\hVGakg14U)