Videos
Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.
- Distribution Method : Unknown
- MD5 : d6d956267a268c9dcf48445629d2803e
- Major Detection Name : HEUR:Trojan-Ransom.MSIL.Thanos.gen (Kaspersky), Ransom-Thanos!D6D956267A26 (McAfee)
- Encrypted File Pattern : .crypted
- Malicious File Creation Location :
- C:\Users\%UserName%\AppData\Local\Temp\<Random>.exe
- C:\Users\%UserName%\AppData\Local\Temp\HOW_TO_DECYPHER_FILES.txt
- C:\Users\%UserName%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk
- C:\Users\%UserName%\Desktop\HOW_TO_DECYPHER_FILES.hta
- Payment Instruction File : HOW_TO_DECYPHER_FILES.hta / HOW_TO_DECYPHER_FILES.txt
- Major Characteristics :
- Offline Encryption
- Prometheus Ransomware series
- Disable Windows Defender ("powershell" Get-MpPreference -verbose, reg.exe delete HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend /f)
- Block processes execution (mspub.exe, mydesktopqos.exe, mydesktopservice.exe)
- Stop multi services (avpsus, BMR Boot Service, DefWatch, McAfeeDLPAgentService, mfewc, NetBackup BMR MTFTP etc.)
- Disable multi services (sc.exe config SQLTELEMETRY start= disabled, sc.exe config SQLTELEMETRY$ECWDB2 start= disabled, sc.exe config SQLWriter start= disabled, sc.exe config SstpSvc start= disabled)
- Disable system restore (vssadmin.exe Delete Shadows /all /quiet, vssadmin.exe resize shadowstorage /for=<Drive Letter>: /on=<Drive Letter>: /maxsize=401MB, vssadmin.exe resize shadowstorage /for=<Drive Letter>: /on=<Drive Letter>: /maxsize=unbounded)
- Delete backup files (<Drive Letter>:\*.bac, <Drive Letter>:\*.bak, <Drive Letter>:\*.bkf, <Drive Letter>:\*.dsk, <Drive Letter>:\*.set, <Drive Letter>:\*.VHD, <Drive Letter>:\*.wbcat, <Drive Letter>:\*.win, <Drive Letter>:\Backup*.*, <Drive Letter>:\backup*.*)
- Empty the trash ("cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin)