Videos
Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.
- Distribution Method : Unknown
- MD5 : 640f1fbe6a480ff41992c47fbdad6849
- Major Detection Name : Generic.Ransom.BTCWare.D2054355 (BitDefender), Ransom:Win32/Betisrypt (Microsoft)
- Encrypted File Pattern : .[nochanse@tuta.io].aleta
- Malicious File Creation Location :
- C:\Users\%UserName%\AppData\Roaming\Info.hta
- C:\Users\%UserName%\AppData\Roaming\key.aleta
- C:\Users\%UserName%\Desktop\!#_READ_ME_#!.hta
- Payment Instruction File : !#_READ_ME_#!.hta / Info.hta
- Major Characteristics :
- Offline Encryption
- Aleta / Crptxxx / Gryphon / Master Ransomware series
- Disable system restore (vssadmin.exe Delete Shadows /All /Quiet, bcdedit.exe /set {default} recoveryenabled No, bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures)