Videos

Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.

  • Distribution Method : Mail attachment (.doc)
 
  • MD5 : edd0c25adef8d4d06c0bb9df43609032
 
  • Major Detection Name : Win32/Filecoder.NOL (ESET), VirTool:Win32/CeeInject (Microsoft)
 
  • Encrypted File Pattern : .<4 Digits Random Extension> → <Original Filename>.<Original Extension>
 
  • Malicious File Creation Location :
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Data
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Data\geoip
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Data\geoip6
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Tor
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Tor\libeay32.dll
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Tor\libevent_core-2-0-5.dll
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Tor\libevent_extra-2-0-5.dll
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Tor\libevent-2-0-5.dll
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Tor\libgcc_s_sjlj-1.dll
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Tor\libssp-0.dll
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Tor\ssleay32.dll
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Tor\svchost.exe
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Tor\tor-gencert.exe
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Tor\zlib1.dll
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\taskwgr.exe
         - C:\Users\%UserName%\AppData\Roaming\tor
 
  • Payment Instruction File : ReadMe.htm / ReadMe.txt
 
  • Major Characteristics : Changes desktop background (C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\test1.bmp)

List

위로