Globe Ransomware (<Random Filename>.duhust) - Videos - CheckMAL

Videos

Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.

Distribution Method : Unknown

MD5 : 5fdf7ae10302b5734e4e93b50eb08cef

Major Detection Name : Ransom:Win32/Genasom (Microsoft), Ransom_PURGE.SM2 (Trend Micro)

Encrypted File Pattern : <Random Filename>.duhust

Malicious File Creation Location :
- C:\Users\%UserName%\AppData\Local\svchost.exe
- C:\Users\%UserName%\How to restore files.hta

Payment Instruction File : How to restore files.hta

Major Characteristics :
- Offline Encryption
- Disable system restore (vssadmin.exe Delete Shadows /All /Quiet, bcdedit.exe /set {default} recoveryenabled No, bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures)