Videos

Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.

  • Distribution Method : Automatic infection using exploit by visiting website
 
  • MD5 : 312d41c49d918ff2692277ce79ed8246
 
  • Major Detection Name : a variant of Win32/GenKryptik.BJZO (ESET), Trojan-Ransom.Win32.Gen.gmq (Kaspersky)
 
  • Encrypted File Pattern : <Original Filename>.<Original Extension>
 
  • Malicious File Creation Location :
         - C:\Users\%UserName%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\<Random>\index[Number].htm
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.bat
         - C:\Users\Public\window.bat
 
  • Payment Instruction File : DECRYPT_INFORMATION.html
 
  • Major Characteristics :
         - Offline Encryption
         - Delete backup files (Backup*.* / backup*.* / *.bac / *.bak / *.bkf / *.dsk / *.set / *.VHD / *.wbcat / *.win)
         - Disable system restore (vssadmin Delete Shadows /all /quiet)

List

위로