Videos

Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.

KeyPass Ransomware (.KEYPASS)

  • Distribution Method : Unknown
 
  • MD5 : 901d893f665c6f9741aa940e5f275952
 
  • Major Detection Name : Ransom-O (McAfee), Ransom_ENCODER.THHADAH (Trend Micro)
 
  • Encrypted File Pattern : .KEYPASS
 
  • Malicious File Creation Location :
     - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\!!!KEYPASS_DECRYPTION_INFO!!!.txt
     - C:\Users\%UserName%\AppData\Local\Temp\delself.bat
     - C:\Users\%UserName%\AppData\Local\<Random>.exe
     - C:\Users\%UserName%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!!!KEYPASS_DECRYPTION_INFO!!!.txt
 
  • Payment Instruction File : !!!KEYPASS_DECRYPTION_INFO!!!.txt
 
  • Major Characteristics :
     - Offline Encryption
     - STOP Ransomware series
     - Excludes Windows and web browser (Chrome, Internet Explorer, Firefox) folders

List

위로