映像
様々なランサムウェアに対応するAppCheckの事前防御、自動復旧およびリアルタイムバックアップ機能を映像でご確認いただけます。
- Distribution Method : Remote access through Remote Desktop Protocol(RDP) or Terminal Services
- MD5 : 12a4388ade3fad199631f6a00894104c
- Major Detection Name : Generic.Ransom.LockCrypt.7B3DBE93 (BitDefender), Ransom.DXXD (Malwarebytes)
- Encrypted File Pattern : <Random> ID <Random>.lock
- Malicious File Creation Location :
- C:\Windows\bfsvcm.exe
- C:\ReadMe.TxT
- Payment Instruction File : ReadMe.TxT
- Major Characteristics :
- Offline Encryption
- Encryption starts after killing all process except listed in whitelist processes
- Display a ransomware message on the Windows logon screen