Videos

Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.

Yatron Ransomware (.Yatron)

  • Distribution Method : Unknown
 
  • MD5 : 96e08acb68b81da0bf4985eae10ebde2
 
  • Major Detection Name : Ransom.Yatron (Malwarebytes), Ransom:Win32/Yatron.SA (Microsoft)
 
  • Encrypted File Pattern : .Yatron
 
  • Payment Instruction File : Read@My.txt
 
  • Major Characteristics :
     - Offline Encryption
     - Hidden-Tear open source based ransomware
     - Block processes execution (ProcessHacker, procexp, vmware, wireshark etc.)
     - Disable system restore (vssadmin.exe delete shadows /all /quiet, wmic.exe shadowcopy delete, bcdedit /set {default} bootstatuspolicy ignoreallfailures, bcdedit /set {default} recoveryenabled no, wbadmin delete catalog -quiet)
     - Network propagation function using EternalBlue SMB vulnerability (DoublePulsar + EternalBlue)
     - Includes ability of propagate through  P2P Sharing applications (BearShare, eMule, Kazaa etc.)

List

위로