- Distribution Method : Unknown
- MD5 : 447ce7e1ec662d31053dd31705558156
- Major Detection Name : W32/Filecoder_HydraCrypt.M!tr (Fortinet), Ransom.Mole (Malwarebytes)
- Encrypted File Pattern : <Random Filename>.ERROR
- Malicious File Creation Location : C:\ProgramData\<random>.exe
- Payment Instruction File : _HELP_INSTRUCTION.TXT
- Major Characteristics :
- Offline Encryption
- CryptFile2 / CryptoShield / HydraCrypt / Mole / Revenge / Zeta Ransomware series
- Stop system services (sc stop BITS, sc stop ERSvc, sc stop VVS, sc stop WerSvc, sc stop WinDefend, sc stop wscsvc, sc stop wuauserv)
- Disable system restore (vssadmin.exe Delete Shadows /All /Quiet, bcdedit /set {default} recoveryenabled No, bcdedit /set {default} bootstatuspolicy ignoreallfailures)
List