映像
様々なランサムウェアに対応するAppCheckの事前防御、自動復旧およびリアルタイムバックアップ機能を映像でご確認いただけます。
- Distribution Method : Remote access through Remote Desktop Protocol(RDP) or Terminal Services
- MD5 : 672ee0c77a8617372c5caf47e227337c
- Major Detection Name : Win32:RATX-gen [Trj] (Avast), Trojan:Win32/Sabsik.FL.B!ml (Microsoft)
- Encrypted File Pattern : .bozon
- Malicious File Creation Location :
- C:\Users\%UserName%\AppData\Local\Temp\<Random>.bat
- C:\Users\%UserName%\AppData\Roaming\Vlbytbq
- C:\Users\%UserName%\AppData\Roaming\Vlbytbq\Kozdg.exe
- Payment Instruction File : FILE RECOVERY.txt
- Major Characteristics :
- Mallox Ransomware series
- File encryption using Microsoft .NET Framework clean file (C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe)
- Block processes execution (fdhost.exe, httpd.exe, java.exe, RAVCp164.exe, reportingservicesservice.exe, sqlservr.exe etc.)
- Stop multi services (CASLicenceServer, DDNSService, OracleOraDb10g_homeliSQL*Plus, TeamViewer8, TPlusStdUpgradeService1220, VMwareHostd etc.)
- Delete multi services (MSCRMAsyncService, Mysoft.SchedulingService, RaAutoInstSrv_RT2870, RTCATS, SPTimerV4, U8KeyManagePool etc.)
- Disable system restore (vssadmin.exe delete shadows /all /quiet, bcdedit /set {current} bootstatuspolicy ignoreallfailures, bcdedit /set {current} recoveryenabled no)