Videos

Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.

  • Distribution Method : Unknown
 
  • MD5 : 808182340fb1b0b0b301c998e855a7c8
 
  • Major Detection Name : Trojan.Ransom.WannaCryptor (ALYac), Ransom.Wannacry (Norton)
 
  • Encrypted File Pattern : .WCRYT → .WCRY
 
  • Malicious File Creation Location :
         - C:\Users\%UserName%\AppData\Roaming\tor
         - \\TaskHost
         - \\TaskHost\Data
         - \\TaskHost\Data\tor
         - \\TaskHost\Tor
         - \\TaskHost\Tor\taskhosts.exe
         - \\TaskHost\Tor\tor.exe
         - \\TaskHost\Tor\tor-gencert.exe
         - \\!Please Read Me!.txt
         - \\!WannaDecryptor!.exe
         - \\!WannaDecryptor!.exe.lnk
         - \\00000000.eky
         - \\00000000.pky
         - \\00000000.res
         - \\b.wry
         - \\c.wry
         - \\m.wry
         - \\r.wry
         - \\t.wry
         - \\u.wry
​​​​​​​
  • Payment Instruction File : !Please Read Me!.txt
​​​​​​​
  • Major Characteristics :
         - Offline Encryption
         - The original file is moved to the temporary folder(%Temp%) or recycle bin(D:\$RECYCLER) in the <number>.WCRYT form
         - Encrypt files after certain processes terminate (taskkill /f /im MSExchange*, taskkill /f /im sqlserver.exe, taskkill /f /im sqlwriter.exe, taskkill /f /im Microsoft.Exchange.*)
         - System Restore disabled("C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet)
         - Changes desktop background(C:\Users\%UserName%\Desktop\!WannaCryptor!.bmp)

List

위로