Videos

Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.

Gopher Ransomware (<Original Filename>.<Original Extension> → <Base64>.NASAcry / HELP-ME-RESTORE-MY-FILES-BACK.html)

  • Distribution Method : Unknown
 
  • MD5 : d467c7c58dd9aa0f13d6d2060eded5ca
 
  • Major Detection Name : Generic.Ransom.Snatch.67508646 (BitDefender), Ransom.MauriGo (Malwarebytes)
 
  • Encrypted File Pattern : <Original Filename>.<Original Extension> → <Base64>.NASAcry
 
  • Malicious File Creation Location : C:\Users\%UserName%\Desktop\FILES_ENCRYPTED.html
 
  • Payment Instruction File : HELP-ME-RESTORE-MY-FILES-BACK.html
 
  • Major Characteristics :
     - Offline Encryption
     - Disable system restore (wmic.exe shadowcopy delete, vssadmin.exe delete shadows /All /Quiet, bcedit /set {default} recoveryenabled No, bcedit /set {default} bootstatuspolicy ignoreallfailures, wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0, wmic SHADOWCOPY DELETE, vssadmin delete shadows /All)

List

위로