Videos
Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.
- Distribution Method : Remote access through Remote Desktop Protocol(RDP) or Terminal Services
- MD5 : 9a02862ac95345359dfc3dcc93e3c10e
- Major Detection Name : Ransom:Win32/Kitoles.A (Microsoft), Ransom_SCARAB.F (Trend Micro)
- Encrypted File Pattern : .scarab
- Malicious File Creation Location : C:\Users\%UserName%\AppData\Roaming\sevnz.exe
- Payment Instruction File : Инструкция по расшифровке.TXT
- Major Characteristics :
- Offline Encryption
- Scarab Ransomware series
- The Russian users targeted
- Block processes execution (msftesql.exe, oracle.exe, sqlagent.exe, sqlbrowser.exe, sqlserver.exe, sqlservr.exe, sqlwriter.exe etc.)
- Disable system restore (wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0, wmic SHADOWCOPY DELETE, vssadmin Delete Shadows /All /Quiet, bcdedit /set {default} recoveryenabled No, bcdedit /set {default} bootstatuspolicy ignoreallfailures)