Videos
Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.
- Distribution Method : Unknown
- MD5 : 53bd1a88422b15fa2da12f1a9136ca7e
- Major Detection Name : Ransom.FileCryptor (Malwarebytes), Ransom.Win64.EVILLOCKR.SMB (Trend Micro)
- Encrypted File Pattern : .evolution
- Payment Instruction File : !#_Read_me_for_revocery_#!.txt
- Major Characteristics :
- Offline Encryption
- Block processes execution (fdlauncher.exe, MsDtsSrvr.exe, ntdbsmgr.exe, oracle.exe, sqlserv.exe, sqlwriter.exe etc.)
- Stop multi services (MSSQL, MSSQLFDLauncher, SQLSERVERAGENT, SSISTELEMETRY130, TMBMServer, vmictimesync etc.)
- Disable system restore (vssadmin delete shadows /all /quiet)