Videos

Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.

King Ouroboros Ransomware (<Original Filename>.king_ouroboros.<Original Extension>)

  • Distribution Method : Unknown
 
  • MD5 : a75ab387db577944d74d7102142f7231
 
  • Major Detection Name : Win32/Filecoder.Ouroboros.A (ESET), Ransom_Genasom.R020C0DGA18 (Trend Micro)
 
  • Encrypted File Pattern : <Original Filename>.king_ouroboros.<Original Extension>
 
  • Malicious File Creation Location :
     - C:\Program Files (x86)\Common Files\log.txt
     - C:\Users\%UserName%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\setup.exe
 
  • Payment Instruction File : README!!! ALL YOUR FILES HAVE BEEN SECURELY ENCRYPTED!!!.txt
 
  • Major Characteristics :
     - Offline Encryption
     - Disable system restore (vssadmin.exe Delete Shadows /All /Quiet, bcdedit /set {default} recoveryenabled No, bcdedit /set {default} bootstatuspolicy ignoreallfailures)
     - After completion of encryption, windows reboots automatically (shutdown -r -f -t 5)
     - Disable and Blocks Task Manager (DisableTaskMgr)
     - Display a ransomware message on the Windows logon screen
     - Changes desktop background (C:\Program Files\Common Files\wallpaper.jpg)

List

위로