映像

様々なランサムウェアに対応するAppCheckの事前防御、自動復旧およびリアルタイムバックアップ機能を映像でご確認いただけます。

  • Distribution Method : Automatic infection using exploit by visiting website
 
  • MD5 : 312d41c49d918ff2692277ce79ed8246
 
  • Major Detection Name : a variant of Win32/GenKryptik.BJZO (ESET), Trojan-Ransom.Win32.Gen.gmq (Kaspersky)
 
  • Encrypted File Pattern : <Original Filename>.<Original Extension>
 
  • Malicious File Creation Location :
         - C:\Users\%UserName%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\<Random>\index[Number].htm
         - C:\Users\%UserName%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.bat
         - C:\Users\Public\window.bat
 
  • Payment Instruction File : DECRYPT_INFORMATION.html
 
  • Major Characteristics :
         - Offline Encryption
         - Delete backup files (Backup*.* / backup*.* / *.bac / *.bak / *.bkf / *.dsk / *.set / *.VHD / *.wbcat / *.win)
         - Disable system restore (vssadmin Delete Shadows /all /quiet)

リスト

위로