Videos

Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.

Ragnarok Ransomware (.<5-Digit Random>.hela)

  • Distribution Method : Unknown
 
  • MD5 : 65c3956288e16bdcc55e3c9c6b94ba5b
 
  • Major Detection Name : Ransom:Win32/Ragnarok.PC!MTB (Microsoft), Ransom.Win32.RAGNAR.SMTH (Trend Micro)
 
  • Encrypted File Pattern : .<5-Digit Random>.hela
 
  • Payment Instruction File : !!Read_Me.<5-Digit Random>.html
 
  • Major Characteristics :
     - Offline Encryption
     - Turns off Windows Firewall (netsh advfirewall set allprofiles state off)
     - Disable Windows Defender (DisableAntiSpyware, DisableRealtimeMonitoring, DisableBehaviorMonitoring, DisableOnAccessProtection)
     - Block processes execution (Exchange*, note*, powerpnt*, python*, sql*, winword* etc.)
     - Disable system restore (vssadmin delete shadows /all /quiet, wmic shadowcopy delete /nointeractive, bcdedit /set {current} bootstatuspolicy ignoreallfailures, bcdedit /set {current} recoveryenabled no)
     - Automatically shuts down Windows after file encryption is complete (shutdown -s -t 0)

List

위로