Videos

Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.

  • Distribution Method : Downloading .appx file via fake web browser update messages
 
  • MD5 : 4fa1c2e75d0d5e0ef087538fe3c79824
 
  • Encrypted File Pattern : .<7~9Digit English Small Letter Random>
 
  • Malicious File Creation Location :
     - C:\Program Files\WindowsApps\3669e262-ec02-4e9d-bcb4-3d008b4afac9_96.0.1072.0_neutral__vgngsjmdj8sje
     - C:\Program Files\WindowsApps\3669e262-ec02-4e9d-bcb4-3d008b4afac9_96.0.1072.0_neutral__vgngsjmdj8sje\<Random>
     - C:\Program Files\WindowsApps\3669e262-ec02-4e9d-bcb4-3d008b4afac9_96.0.1072.0_neutral__vgngsjmdj8sje\<Random>\<Random>.dll
     - C:\Program Files\WindowsApps\3669e262-ec02-4e9d-bcb4-3d008b4afac9_96.0.1072.0_neutral__vgngsjmdj8sje\<Random>\<Random>.exe
     - C:\Users\Public\readme.txt
 
  • Payment Instruction File : readme.txt
 
  • Major Characteristics :
     - Use a "Foresee Consulting Inc." Digital Signatures
     - Disable system restore (vssadmin.exe Delete Shadows /all /quiet)

List

위로