映像
様々なランサムウェアに対応するAppCheckの事前防御、自動復旧およびリアルタイムバックアップ機能を映像でご確認いただけます。
- Distribution Method : Unknown
- MD5 : 5f4c9824ae0a9134050a7ae8ac1e555a
- Major Detection Name : Gen:Variant.Ransom.CryptoMix.2 (BitDefender), Ransom.Troldesh (Norton)
- Encrypted File Pattern : <Random Filename>.WORK
- Malicious File Creation Location : C:\ProgramData\<Random>.exe
- Payment Instruction File : _HELP_INSTRUCTION.TXT
- Major Characteristics :
- Offline Encryption
- CryptFile2 / CryptoShield / HydraCrypt / Mole / Revenge / Zeta Ransomware series
- Stop system services (sc stop BITS, sc stop ERSvc, sc stop VVS, sc stop WerSvc, sc stop WinDefend, sc stop wscsvc, sc stop wuauserv)
- Disable system restore (vssadmin.exe Delete Shadows /All /Quiet, bcdedit /set {default} recoveryenabled No, bcdedit /set {default} bootstatuspolicy ignoreallfailures)