Videos

Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.

  • Distribution Method : Remote program installation via hacking of an MS-SQL administrator account.
 
  • MD5 : 666aa98dacc7a1454d2c92c2ddf16190
 
  • Major Detection Name : TR/FileCoder.jcatq (Avira), Trojan-Ransom.Win64.Agent.dvq (Kaspersky)
 
  • Encrypted File Pattern : <Original Filename>.<Original Extension>
 
  • Malicious File Creation Location :
     - C:\Users\Public\64.bat
     - C:\Users\Public\app.txt
     - C:\Users\Public\jg.txt
     - C:\Users\Public\pepe.txt
 
  • Message File : how_to_decrypt.txt / Как расшифровать.txt / 如何解密.txt
 
  • Major Characteristics :
     - Offline Encryption
     - The Chinese, English and Russian users are targeted.
     - Block processes execution (mysqld.exe, sqlservr.exe)
     - Stopping the MSSQLSERVER service and changing its startup configuration. (sc config MSSQLSERVER start= disabled)
     - Disable system restore. (vssadmin Resize ShadowStorage /For=<Drive Letter (C~F)>: /On=<Drive Letter (C~F)>: /MaxSize=320MB)

List

위로