Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.

Anatova Ransomware (<Original Filename>.<Original Extension>)

  • Distribution Method : Unknown
  • MD5 : 9d844d5480eec1715b18e3f6472618aa
  • Major Detection Name : a variant of Win64/Filecoder.Anatova.A (ESET), Trojan-Ransom.Win64.Anatova.f (Kaspersky)
  • Encrypted File Pattern : <Original Filename>.<Original Extension>
  • Payment Instruction File : ANATOVA.TXT
  • Major Characteristics :
     - Offline Encryption
     - Block processes execution (msftesql.exe, mysqld.exe, outlook.exe, sqlagent.exe, sqlserver.exe, steam.exe etc.)
     - Disable system restore (vssadmin delete shadows /all /quiet)