Videos

Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.

Erebus Ransomware (<Original Filename>.<Random Extension>)

  • Distribution Method : Unknown
 
  • MD5 : 0ced87772881b63caf95f1d828ba40c5
 
  • Major Detection Name : Trojan.Ransom.Erebus (ALYac), Ransom:Win32/Erebus.A!rsm (Microsoft)
 
  • Encrypted File Pattern : <Original Filename>.<Random Extension>
 
  • Malicious File Creation Location :
         - C:\Users\%UserName%\AppData\Local\Temp\tor
         - C:\Users\%UserName%\AppData\Local\Temp\tor\Data
         - C:\Users\%UserName%\AppData\Local\Temp\tor\Data\Tor
         - C:\Users\%UserName%\AppData\Local\Temp\tor\Tor
         - C:\Users\%UserName%\AppData\Local\Temp\tor\Tor\libeay32.dll
         - C:\Users\%UserName%\AppData\Local\Temp\tor\Tor\libevent_core-2-0-5.dll
         - C:\Users\%UserName%\AppData\Local\Temp\tor\Tor\libevent_extra-2-0-5.dll
         - C:\Users\%UserName%\AppData\Local\Temp\tor\Tor\libevent-2-0-5.dll
         - C:\Users\%UserName%\AppData\Local\Temp\tor\Tor\libgcc_s_sjlj-1.dll
         - C:\Users\%UserName%\AppData\Local\Temp\tor\Tor\libssp-0.dll
         - C:\Users\%UserName%\AppData\Local\Temp\tor\Tor\ssleay32.dll
         - C:\Users\%UserName%\AppData\Local\Temp\tor\Tor\tor.exe
         - C:\Users\%UserName%\AppData\Local\Temp\tor\Tor\tor-gencert.exe
         - C:\Users\%UserName%\AppData\Local\Temp\tor\Tor\zlib1.dll
         - C:\Users\%UserName%\AppData\Local\Temp\tor.zip
         - C:\Users\%UserName%\AppData\Roaming\tor
 
  • Payment Instruction File : README.html
 
  • Major Characteristics :
         - Offline Encryption
         - Virtual environment check
         - Changes encryption target file extension to ROT-23
         - Modifies HKEY_CLASSES_ROOT\mscfile\shell\open\command default registry to detour User Account Control (UAC)

List

위로