映像

様々なランサムウェアに対応するAppCheckの事前防御、自動復旧およびリアルタイムバックアップ機能を映像でご確認いただけます。

  • Distribution Method : Mail attachment (.doc)
 
  • MD5 : edd0c25adef8d4d06c0bb9df43609032
 
  • Major Detection Name : Win32/Filecoder.NOL (ESET), VirTool:Win32/CeeInject (Microsoft)
 
  • Encrypted File Pattern : .<4 Digits Random Extension> → <Original Filename>.<Original Extension>
 
  • Malicious File Creation Location :
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Data
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Data\geoip
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Data\geoip6
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Tor
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Tor\libeay32.dll
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Tor\libevent_core-2-0-5.dll
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Tor\libevent_extra-2-0-5.dll
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Tor\libevent-2-0-5.dll
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Tor\libgcc_s_sjlj-1.dll
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Tor\libssp-0.dll
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Tor\ssleay32.dll
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Tor\svchost.exe
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Tor\tor-gencert.exe
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\Tor\zlib1.dll
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\taskwgr.exe
         - C:\Users\%UserName%\AppData\Roaming\tor
 
  • Payment Instruction File : ReadMe.htm / ReadMe.txt
 
  • Major Characteristics : Changes desktop background (C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>\test1.bmp)

リスト

위로