Videos

Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.

  • Distribution Method : Unknown
 
  • MD5 : 29988e576c8be35c09d90f24c8cff7b0
 
  • Major Detection Name : Ransom_MILICRY.GRO (Trend Micro), Trojan.Win32.S.Hermes.668160 (ViRobot)
 
  • Encrypted File Pattern : .HRM
 
  • Malicious File Creation Location :
         - C:\Users\%UserName%\AppData\Local\Temp\<Random>.tmp.exe
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.bat
         - C:\Users\Public\window.bat
 
  • Payment Instruction File : DECRYPT_INFORMATION.html
 
  • Major Characteristics :
         - Offline Encryption
         - Delete backup files (Backup*.* / *.bac / *.bak / *.bkf / *.dsk / *.set / *.VHD / *.wbcat / *.win)
         - Disable system restore (vssadmin Delete Shadows /all /quiet)

List

위로