Videos
Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.
- Distribution Method : Unknown
- MD5 : 2330dfb0343f09733446e3f8f0813f57
- Major Detection Name : Trojan-Ransom.Win32.Blocker.kblm (Kaspersky), Trj/RansomCrypt.E (Panda)
- Encrypted File Pattern : .id_<Random>_email_crts@dr.com_.scl
- Malicious File Creation Location :
- C:\Users\%UserName%\AppData\Roaming\AdobeFlashPlayer_<Random>.exe
- C:\Users\%UserName%\Documents\HELP_YOUR_FILES.HTML
- Payment Instruction File : HELP_YOUR_FILES.HTML / HELP_YOUR_FILES.TXT
- Major Characteristics :
- CryptFile2 / CryptoShield / HydraCrypt / Mole / Revenge / Zeta Ransomware series
- Disable system restore (vssadmin.exe Delete Shadows /All /Quiet, bcdedit /set {default} recoveryenabled No, bcdedit /set {default} bootstatuspolicy ignoreallfailures, bcdedit /set bootstatuspolicy ignoreallfailures, bcdedit /set recoveryenabled NO, wbadmin delete catalog -quiet)
- Adds ransomware executable to USB Drive (Microsoft Adobe Reader Attention.exe)