Videos
Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.
- Distribution Method : Remote program installation via hacking of an MS-SQL administrator account.
- MD5 : d16d5a50d5c9f96778206b5f715a10ea
- Major Detection Name : Win32:CrypterX-gen [Trj] (Avast), Trojan:MSIL/AsyncRAT.I!MTB (Microsoft)
- Encrypted File Pattern : .xollam
- Message File : FILE RECOVERY.txt / HOW TO RECOVER !!.TXT
- Major Characteristics :
- Encrypts files using the legitimate executable "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe".
- Encryption is first performed on files with specific extensions. (.bak, .dbf, .dmp, .hdd, .ibd, .lck, .mdb, .mdf, .nvram, .ora, .oraenv, .rar, .smd, .sql, .vdi, .vhd, .vhdx, .vmdk, .vmem, .vmsd, .vmsn, .vmss, .vmx, .zip)
- Blocks the execution of specific processes. (such as Cobian.exe, MessageNotification.exe, ReportingServicesService.exe, SqlManagement.exe, tomcat9.exe and TongBackupSrv.exe)
- Deletes specific services. (such as cbVSCService11, ReportServer$SQLEXPRESS, SQLSERVERAGENT, SSSyncService, TongBackupSrv and XT800Service_Personal)
- Stops specific services. (such as cbVSCService, NetBackup Legacy Network Service, SAPB1iEventSender, SQLBackupAndFTP Client Service, UFNet and vmvss)
- Changes the startup type of specific services to Disabled using commands such as sc config "MSSQLFDLauncher" start= disabled, sc config MSSQLSERVER start=disabled, sc config "MSSQLServerOLAPService" start= disabled, sc config "SQL Server (MSSQLSERVER)" start=disabled, sc config "TMBMServer" start= disabled and sc config vss start=disabled.
- Disable system restore. (bcdedit /set {current} bootstatuspolicy ignoreallfailures, vssadmin.exe delete shadows /all /quiet, bcdedit /set {current} recoveryenabled no)