映像
様々なランサムウェアに対応するAppCheckの事前防御、自動復旧およびリアルタイムバックアップ機能を映像でご確認いただけます。
- Distribution Method : Installation through a "Toxic Proxy Grabber" repackaged program
- MD5 : 8631a8f38c49a008fa27a1206378e144
- Major Detection Name : Ransom:MSIL/Ryzerlo.A (Microsoft), Ransom_CRYPTESLA.YUYALN (Trend Micro)
- Encrypted File Pattern : .exo
- Malicious File Creation Location :
- C:\Users\%UserName%\AppData\Local\Temp\1.exe
- C:\Users\%UserName%\AppData\Local\Temp\2.exe
- C:\Users\%UserName%\AppData\Roaming\ExoGUI.exe
- Payment Instruction File : UnlockYourFiles0.txt ~ UnlockYourFiles49.txt
- Major Characteristics :
- ExoLock Ransomware series
- Disable system restore (vssadmin.exe delete shadows /for=c: /all)