Videos
Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.
- Distribution Method : Unknown
- MD5 : 45ef76162698b6df8a956ed8b098ad67
- Major Detection Name : Ransom:Win32/Babuk.MAK!MTB (Microsoft), Ransom.Win64.AGAINCRYPT.THGOGBB (Trend Micro)
- Encrypted File Pattern : .again
- Message File : How To Restore Your Files.txt
- Major Characteristics :
- Offline Encryption
- Abyss Locker / AstraLocker / ChiChi Locker / Dark Angels Team / DARKY LOCK / Delta Plus / Pandora / RA Group / Rook Ransomware series.
- Recovery Partition (M:\) + EFI System Partition (N:\) drives are activate.
- Block processes execution. (avp.exe, AvastUI.exe, CNTAoSMgr.exe, MsMpEng.exe, ntrtscan.exe, TmCCSF.exe etc.)
- Stop multi services. (IISADMIN, MSSQLServerADHelper100, ReportServer$ISARS, ShadowProtectSvc, SQLAgent$ISARS, WinDefend etc.)
- Disable system restore. (vssadmin.exe delete shadows /all /quiet, wmic SHADOWCOPY DELETE, bcdedit / set{ default } recoveryenabled No, bcdedit / set{ default } bootstatuspolicy ignoreallfailures)