Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.

Yatron Ransomware (.Yatron)

  • Distribution Method : Unknown
  • MD5 : 96e08acb68b81da0bf4985eae10ebde2
  • Major Detection Name : Ransom.Yatron (Malwarebytes), Ransom:Win32/Yatron.SA (Microsoft)
  • Encrypted File Pattern : .Yatron
  • Payment Instruction File : Read@My.txt
  • Major Characteristics :
     - Offline Encryption
     - Hidden-Tear open source based ransomware
     - Block processes execution (ProcessHacker, procexp, vmware, wireshark etc.)
     - Disable system restore (vssadmin.exe delete shadows /all /quiet, wmic.exe shadowcopy delete, bcdedit /set {default} bootstatuspolicy ignoreallfailures, bcdedit /set {default} recoveryenabled no, wbadmin delete catalog -quiet)
     - Network propagation function using EternalBlue SMB vulnerability (DoublePulsar + EternalBlue)
     - Includes ability of propagate through  P2P Sharing applications (BearShare, eMule, Kazaa etc.)