Videos

Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.

  • Distribution Method : Unknown
 
  • MD5 : 8dffac3010279c41843668c2b5be8219
 
  • Major Detection Name : Ransomware/Win.Monster.R584871 (AhnLab V3), Ransom:Win32/Filecoder!MSR (Microsoft)
 
  • Encrypted File Pattern : .[<Random>].hack3dlikeapro
 
  • Malicious File Creation Location :
     - C:\ProgramData\Installed Updates.{D450A8A1-9568-45C7-9C0E-B4F9FB4537BD}
     - C:\ProgramData\Installed Updates.{D450A8A1-9568-45C7-9C0E-B4F9FB4537BD}\.hack3dlikeapro
     - C:\ProgramData\Installed Updates.{D450A8A1-9568-45C7-9C0E-B4F9FB4537BD}\<Random>.exe
     - C:\ProgramData\Installed Updates.{D450A8A1-9568-45C7-9C0E-B4F9FB4537BD}\private.sys
     - C:\ProgramData\Installed Updates.{D450A8A1-9568-45C7-9C0E-B4F9FB4537BD}\public.sys
     - C:\ProgramData\Installed Updates.{D450A8A1-9568-45C7-9C0E-B4F9FB4537BD}\secure.sys
     - C:\Users\%UserName%\AppData\Local\Temp\PRNALLRP.SYS
 
  • Message File : WE CAN RECOVER YOUR DATA.txt
 
  • Major Characteristics :
     - Offline Encryption
     - Beast / Buran / Jumper / VegaLocker / Vice Society / Zeppelin Ransomware series
     - Block processes execution (agntsvc.exe, dbeng50.exe, mspub.exe, ocomm.exe, winword.exe, xfssvccon.exe etc.)
     - Stop multi services (AcrSch2Svc, backup, PDVFSService, VeeamDeploymentService, vss, zhudongfangyu etc.)

List

위로