更新者 : Arianne Grace Dela Cruz
 別名:

Trojan.Win32.Zudochka.bcx (KASPERSKY); TR/AD.SodinoRansom.wuwtd (ANTIVIR)

 プラットフォーム:

Windows

 危険度:
 ダメージ度:
 感染力:
 感染確認数:
 情報漏えい:

  • マルウェアタイプ:
    身代金要求型不正プログラム（ランサムウェア）

  • 破壊活動の有無:
    なし

  • 暗号化:
    はい

  • 感染報告の有無 :
    はい

  概要

感染経路 インターネットからのダウンロード, 他のマルウェアからの作成

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

  詳細

ファイルサイズ 679,936 bytes
タイプ EXE
メモリ常駐 なし
発見日 2019年9月8日
ペイロード URLまたはIPアドレスに接続, 情報収集, メッセージボックスの表示, システムのレジストリの変更, ファイルの暗号化

侵入方法

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

マルウェアは、以下のファイルを作成します。

  • %User Temp%\{random}.bmp - ransom wallpaper
  • {encrypted folder}\{appended random extension}-HOW-TO-DECRYPT.txt - ransom note

(註：%User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。)

マルウェアは、以下のプロセスを追加します。

  • powershell.exe -e {base64 encoded command} - used to delete shadow copies

他のシステム変更

マルウェアは、以下のレジストリキーを追加します。

HKEY_LOCAL_MACHINE\SOFTWARE\QtProject

HKEY_LOCAL_MACHINE\SOFTWARE\QtProject\
OrganizationDefaults

マルウェアは、以下のレジストリ値を追加します。

HKEY_LOCAL_MACHINE\SOFTWARE\QtProject\
OrganizationDefaults
3Wl = “{random characters}”

HKEY_LOCAL_MACHINE\SOFTWARE\QtProject\
OrganizationDefaults
jJYy = {hex characters}

HKEY_LOCAL_MACHINE\SOFTWARE\QtProject\
OrganizationDefaults
TsXfn = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\QtProject\
OrganizationDefaults
Xq71vG = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\QtProject\
OrganizationDefaults
SdXX6SS = ".{random extension}"

HKEY_LOCAL_MACHINE\SOFTWARE\QtProject\
OrganizationDefaults
0kjPJSH2 = "{random characters}"

マルウェアは、コンピュータのデスクトップの壁紙に以下の画像を設定します。

プロセスの終了

マルウェアは、感染コンピュータ上で以下のプロセスが常駐されていることを確認した場合、そのプロセスを終了します。

  • mysql.exe

情報漏えい

マルウェアは、以下の情報を収集します。

  • User Name
  • Computer Name
  • Workgroup
  • Systems Architecture
  • Operating System
  • Processor Information

情報収集

マルウェアは、HTTPポスト を介して、収集した情報を以下のURLに送信します。

  • https://{domain}/{string 1}/{string 2}/{random characters}.{string 3} wherein the order is as follows:
      {domain}:
      • {BLOCKED}stdelray.com
      • {BLOCKED}als.com
      • {BLOCKED}0hindsight.info
      • {BLOCKED}ywebs.com
      • {BLOCKED}intpt.com
      • {BLOCKED}actors.com
      • {BLOCKED}guyentuan.com
      • {BLOCKED}r.com
      • {BLOCKED}enartwalk.org
      • {BLOCKED}ov.com
      • {BLOCKED}uppe.ch
      • {BLOCKED}rime.com
      • {BLOCKED}abalhos.com
      • {BLOCKED}emmobil.com.tr
      • {BLOCKED}mputers.com
      • {BLOCKED}shstudio.co.uk
      • {BLOCKED}terroristwarningcompany.com
      • {BLOCKED}consultingcompany.com
      • {BLOCKED}le.org
      • {BLOCKED}a.info
      • {BLOCKED}ign.com
      • {BLOCKED}um.com
      • {BLOCKED}edeyecare.com
      • {BLOCKED}ed-removals.co.uk
      • {BLOCKED}e-refle.com
      • {BLOCKED}a.com
      • {BLOCKED}ejserallinclusive.dk
      • {BLOCKED}gemsehondenschool.be
      • {BLOCKED}eassemble.fr
      • {BLOCKED}ewho-aixenprovence.fr
      • {BLOCKED}atwentytwenty.com
      • {BLOCKED}-collectivites.com
      • {BLOCKED}arm.dk
      • {BLOCKED}urismocastagneto.it
      • {BLOCKED}loftladders.co.uk
      • {BLOCKED}age.com
      • {BLOCKED}publishing.co.uk
      • {BLOCKED}rviceunlimited.com
      • {BLOCKED}pourbarrier.com
      • {BLOCKED}agofis.com
      • {BLOCKED}friskcenter.se
      • {BLOCKED}a-safaris.com
      • {BLOCKED}maroofingllc.com
      • {BLOCKED}aremote.com
      • {BLOCKED}ekniksipil.com
      • {BLOCKED}eaner.fr
      • {BLOCKED}e.com
      • {BLOCKED}e.co
      • {BLOCKED}enzel.de
      • {BLOCKED}sunindo.com
      • {BLOCKED}dentalcare.com
      • {BLOCKED}onecampaign.com
      • {BLOCKED}gsrassismus-entknoten.de
      • {BLOCKED}idwifery.com
      • {BLOCKED}tus.com
      • {BLOCKED}iberie.com
      • {BLOCKED}udeboise.com
      • {BLOCKED}ontatto.net
      • {BLOCKED}sdc.com
      • {BLOCKED}o.net.au
      • {BLOCKED}elecompte.wordpress.com
      • {BLOCKED}ellezaysalud.com
      • {BLOCKED}dzac.com
      • {BLOCKED}lor.com
      • {BLOCKED}mattswisswatches.ch
      • {BLOCKED}aluchesi.it
      • {BLOCKED}askildegaard.dk
      • {BLOCKED}eyezstripclub.com
      • {BLOCKED}ika-schwarz.com
      • {BLOCKED}smirrorus.com
      • {BLOCKED}lfood-online.de
      • {BLOCKED}tion-pro.co.uk
      • {BLOCKED}gsregisteret.no
      • {BLOCKED}ymus.com
      • {BLOCKED}a.it
      • {BLOCKED}academy.it
      • {BLOCKED}a.ac
      • {BLOCKED}ista.de
      • {BLOCKED}lerpension.com
      • {BLOCKED}econseils.fr
      • {BLOCKED}heck.co.za
      • {BLOCKED}anmice.com
      • {BLOCKED}i.eus
      • {BLOCKED}ugcleaningnyc.com
      • {BLOCKED}se.pl
      • {BLOCKED}kapitalforvaltning.dk
      • {BLOCKED}rk.nl
      • {BLOCKED}rtgallery.jp
      • {BLOCKED}affing.com
      • {BLOCKED}g.fr
      • {BLOCKED}graphic.com
      • {BLOCKED}erkomon.com
      • {BLOCKED}a.nl
      • {BLOCKED}oup.it
      • {BLOCKED}ives-sur-vareze.fr
      • {BLOCKED}-praxisklinik-rostock.de
      • {BLOCKED}opel.ro
      • {BLOCKED}eamlast.de
      • {BLOCKED}s.mantova.it
      • {BLOCKED}ninthedesert.com
      • {BLOCKED}ss163.ru:443
      • {BLOCKED}log.de
      • {BLOCKED}hauri.com
      • {BLOCKED}pain.com
      • {BLOCKED}love.org:443
      • {BLOCKED}spiritualtamara.com
      • {BLOCKED}ycanas.com
      • {BLOCKED}s.com
      • {BLOCKED}erwork.eu
      • {BLOCKED}b.ch
      • {BLOCKED}tting-hk.helpergo.co
      • {BLOCKED}lics.in
      • {BLOCKED}flot.ru
      • {BLOCKED}a.ac
      • {BLOCKED}a.sk
      • {BLOCKED}ismyyoga.com
      • {BLOCKED}l.co.za
      • {BLOCKED}mbak.com
      • {BLOCKED}tdistinctives.org
      • {BLOCKED}amcfadyenjewelry.com
      • {BLOCKED}entistry.com
      • {BLOCKED}nancialservices.com
      • {BLOCKED}ienden.nl
      • {BLOCKED}reelite.com
      • {BLOCKED}toirs.org
      • {BLOCKED}s.info
      • {BLOCKED}y.com
      • {BLOCKED}ivingschool.com.au
      • {BLOCKED}-traveller.com
      • {BLOCKED}a.af
      • {BLOCKED}iniacademy.org
      • {BLOCKED}oripa.be
      • {BLOCKED}iz.com
      • {BLOCKED}-partner.de
      • {BLOCKED}llp.com
      • {BLOCKED}tter.nl
      • {BLOCKED}edical.de
      • {BLOCKED}ce.com
      • bg.{BLOCKED}in.pl
      • {BLOCKED}a.com
      • {BLOCKED}uck.de
      • {BLOCKED}s.dk
      • {BLOCKED}eflybilletter.dk
      • {BLOCKED}ars.net
      • {BLOCKED}art.com
      • {BLOCKED}tify.ai
      • {BLOCKED}lacemag.com
      • {BLOCKED}anvulpen.nl
      • {BLOCKED}t.fr
      • {BLOCKED}optic.com
      • {BLOCKED}p.com
      • {BLOCKED}kevision.com
      • {BLOCKED}rinefoundation.com
      • {BLOCKED}dgeheritage.com
      • {BLOCKED}nreich-brilon.de
      • {BLOCKED}pure-impulse.com
      • {BLOCKED}50ans.com
      • {BLOCKED}ndchallenger.com
      • {BLOCKED}chversicherung.info
      • {BLOCKED}a.de
      • {BLOCKED}beachassociation.com
      • {BLOCKED}gwheel.com
      • {BLOCKED}slivinglively.com
      • {BLOCKED}ier.org
      • {BLOCKED}endsgoal.site
      • {BLOCKED}ornfastigheter.se
      • {BLOCKED}-immobilien.de
      • {BLOCKED}uckrecords.com
      • {BLOCKED}ebettertolivebetter.com
      • {BLOCKED}cave.com
      • {BLOCKED}hillgroup.com
      • {BLOCKED}ehope.org
      • {BLOCKED}oepke.eu
      • {BLOCKED}neosteopathic.com.au
      • {BLOCKED}lisoep.nl
      • {BLOCKED}woodblog.com
      • {BLOCKED}mmobilier.com
      • {BLOCKED}online
      • {BLOCKED}ucious.com
      • {BLOCKED}enter-butzbach-werbemittel.de
      • {BLOCKED}ddyblog.com
      • {BLOCKED}nnikitav.000webhostapp.com
      • {BLOCKED}deco.site
      • {BLOCKED}n.com
      • {BLOCKED}itare.com
      • {BLOCKED}elem.de
      • {BLOCKED}ness-basic.de
      • {BLOCKED}akers.com
      • {BLOCKED}o.pl
      • {BLOCKED}0.com
      • {BLOCKED}w-okc.com
      • {BLOCKED}glaforetdetesse.com
      • {BLOCKED}ce.com
      • {BLOCKED}escalade.com
      • {BLOCKED}10.it
      • {BLOCKED}ndloyalty.com
      • {BLOCKED}-york.com
      • {BLOCKED}nfriedlander.com
      • {BLOCKED}n.sparen-it.de
      • {BLOCKED}arosa33.it
      • {BLOCKED}depositors.com
      • {BLOCKED}seurdetransformation.com
      • {BLOCKED}p-mag.com
      • {BLOCKED}ng.com
      • {BLOCKED}erts.de
      • {BLOCKED}ec.com
      • {BLOCKED}yvisionglobal.com
      • {BLOCKED}ters.com
      • {BLOCKED}019.com
      • {BLOCKED}fhopeeurope.eu
      • {BLOCKED}sfrancis.photos
      • {BLOCKED}ttelhanna.com
      • {BLOCKED}rlin.de
      • {BLOCKED}rchatterchatter.com
      • {BLOCKED}arehousespace.com
      • {BLOCKED}sy.net
      • {BLOCKED}consulting.net
      • {BLOCKED}anne.com
      • {BLOCKED}ianscholz.de
      • {BLOCKED}opherhannan.com
      • {BLOCKED}rance.fr
      • {BLOCKED}natiphotocompany.org
      • {BLOCKED}citydj.com
      • {BLOCKED}t-diagramz.com
      • {BLOCKED}apes-art.com
      • {BLOCKED}gslife.com
      • {BLOCKED}epamblog.com
      • {BLOCKED}akilian.de
      • {BLOCKED}oomequipment.ie
      • {BLOCKED}foto.dk
      • {BLOCKED}-beethovenstrasse-ag.ch
      • {BLOCKED}d.com
      • {BLOCKED}w.com
      • {BLOCKED}reneuracademy.com
      • {BLOCKED}etennis.info
      • {BLOCKED}d-shelves.com
      • {BLOCKED}rescritor.com
      • {BLOCKED}er-place.de
      • {BLOCKED}tactodirecto.com
      • {BLOCKED}mobile.fr
      • {BLOCKED}n.nl
      • {BLOCKED}auses.org
      • {BLOCKED}marketing.com
      • {BLOCKED}acionrr.com
      • {BLOCKED}-avenue.co.il
      • {BLOCKED}p.de
      • {BLOCKED}ngalegacy.com
      • {BLOCKED}on.com
      • {BLOCKED}tone.co.nz
      • {BLOCKED}n.de
      • {BLOCKED}ood.com
      • {BLOCKED}loons.com
      • {BLOCKED}p.com
      • {BLOCKED}ediation.org
      • {BLOCKED}org
      • {BLOCKED}iscountguns.com
      • {BLOCKED}roasts.com
      • {BLOCKED}any.com
      • {BLOCKED}romote.de
      • {BLOCKED}futbol
      • {BLOCKED}ranch.com
      • {BLOCKED}i.be
      • {BLOCKED}visphotos.com
      • {BLOCKED}townhouse.com
      • {BLOCKED}e-styling.nl
      • {BLOCKED}u.com
      • {BLOCKED}n.com
      • {BLOCKED}ia.fi
      • {BLOCKED}tionhub.com
      • {BLOCKED}gfoodie.nl
      • {BLOCKED}verschuur.com
      • {BLOCKED}circle.com
      • {BLOCKED}labor-luenen.de
      • {BLOCKED}rage.com
      • {BLOCKED}wynkoopdentist.com
      • {BLOCKED}empelking.de
      • {BLOCKED}gandoprogramas.com
      • {BLOCKED}image.ae
      • {BLOCKED}s.be
      • {BLOCKED}de
      • {BLOCKED}an.ru
      • {BLOCKED}ie-weitramsdorf-sesslach.de
      • {BLOCKED}i.store
      • {BLOCKED}niversiteit.nl
      • {BLOCKED}mo-agentur.de
      • {BLOCKED}ambulancealkmaar.nl
      • {BLOCKED}le-elite.de
      • {BLOCKED}rp.com
      • {BLOCKED}inkdetroit.com
      • {BLOCKED}ique.com
      • {BLOCKED}apernambuco.com
      • {BLOCKED}fresh.com
      • {BLOCKED}iestas.com.es
      • {BLOCKED}a.com
      • {BLOCKED}a.co.uk
      • {BLOCKED}foundation.org
      • {BLOCKED}limitedguide.com
      • {BLOCKED}e-des-pothiers.com
      • {BLOCKED}vefurniture.com
      • {BLOCKED}guides.eu
      • {BLOCKED}eniste.com
      • {BLOCKED}nhweeks.com
      • {BLOCKED}oiceclub.org
      • {BLOCKED}onpediatrics.com
      • {BLOCKED}makersheerenveen.nl
      • {BLOCKED}a.de
      • {BLOCKED}p.com
      • {BLOCKED}er.nl
      • {BLOCKED}x.pro
      • {BLOCKED}insteadwingchun.com
      • {BLOCKED}ntal.ae
      • {BLOCKED}eges.com
      • {BLOCKED}e.co
      • {BLOCKED}ennedymacfoy.com
      • {BLOCKED}ors.org
      • {BLOCKED}encyconsulting.es
      • {BLOCKED}u.fr
      • {BLOCKED}danismanlik.com
      • {BLOCKED}icianul.com
      • {BLOCKED}x.is
      • {BLOCKED}ramika-shop.com.ua
      • {BLOCKED}accreative.wordpress.com
      • {BLOCKED}nhlstenden.com
      • {BLOCKED}er-p.net
      • {BLOCKED}er-p.net
      • {BLOCKED}realms.net
      • {BLOCKED}vation.com
      • {BLOCKED}bit-rp.ru
      • {BLOCKED}ca.com
      • {BLOCKED}or-durban.com
      • {BLOCKED}k.com
      • {BLOCKED}logerie.com
      • {BLOCKED}anart.com
      • {BLOCKED}iversforwindows.com
      • {BLOCKED}p.design
      • {BLOCKED}opolitica.com
      • {BLOCKED}z.de
      • {BLOCKED}icsport.eu
      • {BLOCKED}svirtualesexitosos.com
      • {BLOCKED}hacademy.org
      • {BLOCKED}a.nl
      • {BLOCKED}mes.com
      • {BLOCKED}tordallas.com
      • {BLOCKED}iareloj.com
      • {BLOCKED}ywizuk.com
      • {BLOCKED}n.ru
      • {BLOCKED}i.com.au
      • {BLOCKED}nline.com
      • {BLOCKED}star.co
      • {BLOCKED}zine.ru
      • {BLOCKED}tytitleoregon.com
      • {BLOCKED}titutionalfunds.com
      • {BLOCKED}go.eu
      • {BLOCKED}ome.co.uk
      • {BLOCKED}pace.com
      • {BLOCKED}sblenderstory.com
      • {BLOCKED}epair.com
      • {BLOCKED}a.se
      • {BLOCKED}oordental.com
      • {BLOCKED}ingsun.org
      • {BLOCKED}uzrewards.com
      • {BLOCKED}ontur.com
      • {BLOCKED}rverein-vatterschule.de
      • {BLOCKED}imes.ru
      • {BLOCKED}linslimeffect.net
      • {BLOCKED}ittard.nl
      • {BLOCKED}itores.com
      • {BLOCKED}ubna.com
      • {BLOCKED}ays.com
      • {BLOCKED}yballs.com
      • {BLOCKED}hift.it
      • {BLOCKED}oll.com
      • {BLOCKED}ids.com
      • {BLOCKED}-international.es
      • {BLOCKED}pro.com
      • {BLOCKED}sale.com
      • {BLOCKED}lmar.se
      • {BLOCKED}dia.com
      • {BLOCKED}x.de
      • {BLOCKED}d.ru
      • {BLOCKED}networking.com
      • {BLOCKED}herapierijnmond.nl
      • {BLOCKED}ainc.com
      • {BLOCKED}yals.com
      • {BLOCKED}uklaw.com
      • {BLOCKED}e-couture.com
      • {BLOCKED}partner.pl
      • {BLOCKED}burgcottage.com
      • {BLOCKED}asters.com
      • {BLOCKED}e-du-web.com
      • {BLOCKED}1.de
      • {BLOCKED}iatonaggelon.gr
      • {BLOCKED}muncey.com
      • {BLOCKED}b.software
      • {BLOCKED}h.ae
      • {BLOCKED}uck.de
      • {BLOCKED}-pflanzenparadies.de
      • {BLOCKED}erschueren.be
      • {BLOCKED}compliancenews.com
      • {BLOCKED}-migrate.com
      • {BLOCKED}skills.pt
      • go.{BLOCKED}ni.ch
      • {BLOCKED}dleadership.org
      • {BLOCKED}nger-teppichreinigung.de
      • {BLOCKED}ublandgoednieuwkerk.nl
      • {BLOCKED}yscustom.com
      • {BLOCKED}rbalhealth.com
      • {BLOCKED}deep.com
      • {BLOCKED}studio-visuell.de
      • {BLOCKED}nariaregional.com
      • {BLOCKED}cafeblog.wordpress.com
      • {BLOCKED}eenbiomedservices.com
      • {BLOCKED}fficespaces.net
      • {BLOCKED}yetattoo.com
      • {BLOCKED}ider.nl
      • {BLOCKED}dealers.ru
      • {BLOCKED}xin10.com
      • {BLOCKED}retecoatings.com
      • {BLOCKED}b.fr
      • {BLOCKED}d.com
      • {BLOCKED}chnologies.net
      • {BLOCKED}totaal.nl
      • {BLOCKED}lim.com
      • {BLOCKED}an-silkeborg.dk
      • {BLOCKED}atering.de
      • {BLOCKED}ublog.wordpress.com
      • {BLOCKED}streetspineclinic.com
      • {BLOCKED}urniture.com
      • {BLOCKED}andliebe.de
      • {BLOCKED}steelbuilding.com
      • {BLOCKED}rnsretirement.co.uk
      • {BLOCKED}lbygg.no
      • {BLOCKED}m.com
      • {BLOCKED}ymarketing.com
      • {BLOCKED}opping.com
      • {BLOCKED}land-oaze.nl
      • {BLOCKED}see-buhne11.de
      • {BLOCKED}uckwreckers.com.au
      • {BLOCKED}m.com
      • {BLOCKED}s.com
      • {BLOCKED}ne.de
      • {BLOCKED}isor.dk
      • {BLOCKED}alitytrainingsolutions.co.uk
      • {BLOCKED}etdelsindians.es
      • {BLOCKED}tay.com
      • {BLOCKED}gbangladesh.net
      • {BLOCKED}antra.com
      • {BLOCKED}urbo.de
      • {BLOCKED}aneselesbian.com
      • {BLOCKED}ofwa.com
      • {BLOCKED}iruses.org
      • {BLOCKED}anitas.dk
      • {BLOCKED}tyle.co.uk
      • {BLOCKED}ldt.dk
      • {BLOCKED}nforensic.com
      • {BLOCKED}hnologies.net
      • {BLOCKED}de.com
      • {BLOCKED}t99.com
      • {BLOCKED}beton.nl
      • {BLOCKED}us.com
      • {BLOCKED}god.be
      • {BLOCKED}ullcircle.com
      • {BLOCKED}istoria.com
      • {BLOCKED}e-entertainment.com
      • {BLOCKED}ekithomes.co.nz
      • {BLOCKED}ku-sozoku.com
      • {BLOCKED}izadvocates.org
      • {BLOCKED}tar.com
      • {BLOCKED}osextras.online
      • {BLOCKED}nf.com
      • {BLOCKED}urrection.com
      • {BLOCKED}isions-id.com
      • {BLOCKED}tiongames-brabant.nl
      • {BLOCKED}tiongames-brabant.nl
      • {BLOCKED}e.agency
      • {BLOCKED}inkone.com
      • {BLOCKED}alresults.com
      • {BLOCKED}estdigital.com
      • {BLOCKED}a.dk
      • {BLOCKED}r.com
      • {BLOCKED}ine.ru
      • {BLOCKED}idigitali.com
      • {BLOCKED}es.dk
      • {BLOCKED}cu.com
      • {BLOCKED}ekzema.nl
      • {BLOCKED}sgarcianoto.com
      • {BLOCKED}g.me
      • {BLOCKED}ybak.com
      • {BLOCKED}uu.net
      • {BLOCKED}illiamspainting.com
      • {BLOCKED}okus.com
      • {BLOCKED}est.com
      • {BLOCKED}rardon.com
      • {BLOCKED}genstern.com
      • {BLOCKED}terim-and-projectmanagement.com
      • {BLOCKED}nitureco.com
      • {BLOCKED}ter.com
      • {BLOCKED}nti.com
      • {BLOCKED}onalessandro.com
      • {BLOCKED}sultancy.com
      • {BLOCKED}ttmediations.com
      • {BLOCKED}hisme.fr
      • {BLOCKED}onbooks.com
      • {BLOCKED}inezilustrador.com
      • {BLOCKED}i.com.ng
      • {BLOCKED}re.com
      • {BLOCKED}moveamerica.org
      • {BLOCKED}en.com
      • {BLOCKED}nweekly.com
      • {BLOCKED}onmingmanning.com
      • {BLOCKED}y.hu
      • {BLOCKED}ooley.com
      • {BLOCKED}nblaetz.de
      • {BLOCKED}usktherapy.com
      • {BLOCKED}oundthecornerpetsit.com
      • {BLOCKED}are.com
      • {BLOCKED}somnium.de
      • {BLOCKED}njames.com
      • {BLOCKED}iterviertel.com
      • {BLOCKED}ndonesia.com
      • {BLOCKED}inealy.com
      • {BLOCKED}te.com
      • {BLOCKED}hcom
      • {BLOCKED}gatton.com
      • {BLOCKED}ordon.com
      • {BLOCKED}n.fr
      • {BLOCKED}allum.com
      • {BLOCKED}allum.com
      • {BLOCKED}iedjeszingen.nl
      • {BLOCKED}alprep.academy
      • {BLOCKED}-prijs.nl
      • {BLOCKED}oardjournal.com
      • {BLOCKED}x.com
      • {BLOCKED}ittickets.com
      • {BLOCKED}ribeaute-nani.com
      • {BLOCKED}anvent.ru
      • {BLOCKED}i-dress.com
      • {BLOCKED}resory-opravy.com
      • {BLOCKED}ept-m.ru
      • {BLOCKED}ooo.com
      • {BLOCKED}en-vochtbestrijding.be
      • {BLOCKED}hnabrawijaya.com
      • {BLOCKED}tianboennelykke.dk
      • {BLOCKED}phold-sjaelland.dk
      • {BLOCKED}dersnapsen.dk
      • {BLOCKED}tos72.com
      • {BLOCKED}ero.pro
      • {BLOCKED}ymichalovce.sk
      • {BLOCKED}f.de
      • {BLOCKED}bki.ru
      • {BLOCKED}sterplakky.nl
      • {BLOCKED}chools.ng
      • {BLOCKED}goedspica.nl
      • {BLOCKED}oniasafaris.com
      • {BLOCKED}hwoodmarketing.com
      • {BLOCKED}andbrowenvy.com
      • {BLOCKED}crm.com
      • {BLOCKED}leacrepes-meaux.fr
      • {BLOCKED}lvor.com
      • {BLOCKED}swithleslie.com
      • {BLOCKED}valentine.com
      • {BLOCKED}orensics.com
      • {BLOCKED}upremegarcinia.net
      • {BLOCKED}erjees.com
      • {BLOCKED}ucan.com
      • {BLOCKED}dschiess.de
      • {BLOCKED}trom.com
      • {BLOCKED}pblanc.gr
      • {BLOCKED}ldineroux.com
      • {BLOCKED}uxbleus.net
      • {BLOCKED}topsmoking.co.uk
      • {BLOCKED}rscan.de
      • {BLOCKED}seven.be
      • {BLOCKED}covka.ru
      • {BLOCKED}d.com
      • {BLOCKED}nes.com
      • {BLOCKED}sed-public-adjuster.com
      • {BLOCKED}pingsnytt.nu
      • {BLOCKED}rtgrafikweb.at
      • {BLOCKED}nbreaths.com
      • {BLOCKED}rtelyouth.com
      • {BLOCKED}nie.com
      • {BLOCKED}rete.com
      • {BLOCKED}x.co.uk
      • {BLOCKED}uilding.life
      • {BLOCKED}poncon.fr
      • {BLOCKED}esaints.academy
      • {BLOCKED}eveloper.com
      • {BLOCKED}ai.com
      • {BLOCKED}poolabudhabi.ae
      • {BLOCKED}ourheartout.co
      • {BLOCKED}t.sk
      • {BLOCKED}arn.co.uk
      • {BLOCKED}industries.com
      • {BLOCKED}chiro.com
      • {BLOCKED}academy
      • {BLOCKED}ndseen.com
      • {BLOCKED}nille.se
      • {BLOCKED}dager.com
      • {BLOCKED}se.com
      • {BLOCKED}zuchia.com
      • {BLOCKED}nbryan.com
      • {BLOCKED}oupe.com
      • {BLOCKED}l.it
      • {BLOCKED}ro.academy
      • {BLOCKED}uno.com
      • {BLOCKED}c.com
      • {BLOCKED}burger.fr
      • {BLOCKED}lduniya.com
      • {BLOCKED}h.fr
      • {BLOCKED}mputer-support-hamburg.de
      • {BLOCKED}visual.com
      • {BLOCKED}ya.net
      • {BLOCKED}chen.com
      • {BLOCKED}millionaires.net
      • {BLOCKED}nnye.ru
      • {BLOCKED}attalar.com
      • {BLOCKED}nedesigns.com
      • {BLOCKED}irossana.it
      • {BLOCKED}l.tn
      • {BLOCKED}y.com
      • {BLOCKED}tmcshane.com
      • {BLOCKED}sediazdemera.com
      • {BLOCKED}lmahdi.com
      • {BLOCKED}elemenestrel.com
      • {BLOCKED}mourphotography.co.uk
      • {BLOCKED}basin.com
      • {BLOCKED}frets-ceramics.nl
      • {BLOCKED}pstudios.com
      • {BLOCKED}bnb.wordpress.com
      • {BLOCKED}ogicos.com
      • {BLOCKED}uzzaofficial.com
      • {BLOCKED}upetel.fr
      • {BLOCKED}24.com.ua
      • {BLOCKED}ulka.ru
      • {BLOCKED}t.dk
      • {BLOCKED}pi.com.br
      • {BLOCKED}nghomes.com
      • {BLOCKED}lmong.com
      • {BLOCKED}b.co.nz
      • {BLOCKED}supportco.com
      • {BLOCKED}ro.com.ar
      • {BLOCKED}healthandwellness.com
      • {BLOCKED}tgesigte.co.za
      • {BLOCKED}delrio.com
      • {BLOCKED}ngeren.nl
      • {BLOCKED}au-hartmann.eu
      • {BLOCKED}e.ca
      • {BLOCKED}ica.academy
      • {BLOCKED}n.ru
      • {BLOCKED}a.com
      • {BLOCKED}fiegel.com
      • {BLOCKED}s.co.il
      • {BLOCKED}school.org
      • {BLOCKED}opping.it
      • {BLOCKED}e.{BLOCKED}es.de
      • {BLOCKED}goodfellow.co.uk
      • {BLOCKED}uscle.nl
      • {BLOCKED}elers.com
      • {BLOCKED}arkescape.com
      • {BLOCKED}rksomhed.dk
      • {BLOCKED}o.it
      • {BLOCKED}k.digital
      • {BLOCKED}i.ru
      • {BLOCKED}rfil.com
      • {BLOCKED}cristescu.com
      • {BLOCKED}e.nl
      • {BLOCKED}m.pt
      • {BLOCKED}ccarthydesign.com
      • {BLOCKED}andscapes.com
      • {BLOCKED}rrsoccer.com
      • {BLOCKED}sconsult.com
      • {BLOCKED}osshideout.com
      • {BLOCKED}ossplace.co.uk
      • {BLOCKED}r.nl
      • {BLOCKED}ttz.com
      • {BLOCKED}c.com
      • {BLOCKED}p.org
      • {BLOCKED}r.nl
      • {BLOCKED}ieces-auto.fr
      • {BLOCKED}i.pe
      • {BLOCKED}l.de
      • {BLOCKED}gmarketinggroup.com
      • {BLOCKED}eam.com
      • {BLOCKED}win3.com
      • {BLOCKED}smali.net
      • {BLOCKED}t-pismo-gubernatoru.ru:443
      • {BLOCKED}a.net
      • {BLOCKED}newsroom.com
      • {BLOCKED}estaurante.com.br
      • {BLOCKED}p.ru
      • {BLOCKED}marine.dk
      • {BLOCKED}a.co.uk
      • {BLOCKED}c.ca
      • {BLOCKED}n.nl
      • {BLOCKED}amedispa.com
      • {BLOCKED}i.be
      • {BLOCKED}pictures.com
      • {BLOCKED}surecleaning.com
      • {BLOCKED}ltere.fr
      • {BLOCKED}ruralhousingstudies.org
      • {BLOCKED}stop.com
      • {BLOCKED}gefinancial.com
      • {BLOCKED}x.com
      • {BLOCKED}ock.com
      • {BLOCKED}indeklas.be
      • {BLOCKED}i.com
      • {BLOCKED}edia.de
      • {BLOCKED}a.com.ua
      • {BLOCKED}lla.com
      • {BLOCKED}lue.com
      • {BLOCKED}sfiloxenia.gr
      • {BLOCKED}us.com
      • {BLOCKED}well.com.sg
      • {BLOCKED}onsigns.com
      • {BLOCKED}g.org
      • {BLOCKED}yrehospital.dk
      • {BLOCKED}cademy.com
      • {BLOCKED}0.dk
      • {BLOCKED}blog.com
      • {BLOCKED}iness.com
      • {BLOCKED}oisons.fr
      • {BLOCKED}rbella.com
      • {BLOCKED}emy.com
      • {BLOCKED}t.com
      • {BLOCKED}rgyinternational.com
      • {BLOCKED}arketingsurgery.co.uk
      • {BLOCKED}vgroup.com
      • {BLOCKED}vadigital.com
      • {BLOCKED}ebdesign.com
      • {BLOCKED}i.com
      • {BLOCKED}ubertruiz.com
      • {BLOCKED}.com
      • {BLOCKED}b.net
      • {BLOCKED}rdbrickwork.com
      • {BLOCKED}o.ae
      • {BLOCKED}nity.de
      • {BLOCKED}n.ro
      • {BLOCKED}karuva.com
      • {BLOCKED}k.zp.ua
      • {BLOCKED}dingminialbums.com
      • {BLOCKED}ity.com
      • {BLOCKED}e.com
      • {BLOCKED}aal.nl
      • {BLOCKED}s.fr
      • {BLOCKED}a.gr
      • {BLOCKED}hilippines.com
      • {BLOCKED}us-erfurt.de
      • {BLOCKED}s.ru
      • {BLOCKED}atblago.ru
      • {BLOCKED}pod.com
      • {BLOCKED}mlandscape.com
      • {BLOCKED}andkids.com
      • {BLOCKED}hool.ru
      • {BLOCKED}eseniorliving.net
      • {BLOCKED}rt.com
      • {BLOCKED}ciation.com
      • {BLOCKED}cleaning.net
      • {BLOCKED}int-flour.fr
      • {BLOCKED}or.org.tr
      • {BLOCKED}on.com
      • {BLOCKED}ibadan.co.id
      • {BLOCKED}hrambutkeiskei.com
      • {BLOCKED}reenfarmcatering.com.au
      • {BLOCKED}decor.com
      • {BLOCKED}grin.com
      • {BLOCKED}o-group.com
      • {BLOCKED}crane.com
      • {BLOCKED}aphycreativity.co.uk
      • {BLOCKED}g.com
      • {BLOCKED}bepthanhdat.com
      • {BLOCKED}lang.de
      • {BLOCKED}r.com
      • {BLOCKED}een.com
      • {BLOCKED}yvideoawards.com
      • {BLOCKED}ook.com
      • {BLOCKED}e.co
      • {BLOCKED}alth.net
      • {BLOCKED}onticello.com
      • {BLOCKED}rance.com
      • {BLOCKED}or-the-soul.ch
      • {BLOCKED}turkiye.com
      • {BLOCKED}e.com
      • {BLOCKED}retagne.bzh
      • {BLOCKED}ell.su
      • {BLOCKED}temp.com
      • {BLOCKED}-iowa.com
      • {BLOCKED}web.com.ua:443
      • {BLOCKED}e.live
      • {BLOCKED}rineengineering.com
      • {BLOCKED}alblue.com
      • {BLOCKED}ion-stills.co.uk
      • {BLOCKED}ionetata.com
      • {BLOCKED}plo.com
      • {BLOCKED}bersan.com
      • {BLOCKED}z.com
      • {BLOCKED}mer.pl
      • {BLOCKED}tparkiet.pl
      • {BLOCKED}eyagro.com.ua
      • {BLOCKED}s.ca
      • {BLOCKED}play.ca
      • {BLOCKED}n.com
      • {BLOCKED}ompserver.de
      • {BLOCKED}ements.nl
      • {BLOCKED}eprod4.com
      • {BLOCKED}-reinigen.com
      • {BLOCKED}mbv.nl
      • {BLOCKED}l.it
      • {BLOCKED}usiccenter.com
      • {BLOCKED}ternational.com
      • {BLOCKED}ube.net
      • {BLOCKED}corting.com
      • {BLOCKED}ach.com
      • {BLOCKED}etsenblog.nl
      • {BLOCKED}allgood.com
      • {BLOCKED}ightmusic.com
      • {BLOCKED}zprono.com
      • {BLOCKED}brown.com
      • {BLOCKED}kloan.org
      • {BLOCKED}ods.ro
      • {BLOCKED}warehouse.co.uk
      • {BLOCKED}-webzine.nl
      • {BLOCKED}nplicht.be
      • {BLOCKED}i.co
      • {BLOCKED}blephotography.com
      • {BLOCKED}metkinderen.be
      • {BLOCKED}ntonline.eu
      • {BLOCKED}e.kz
      • {BLOCKED}box.ch
      • {BLOCKED}rtman.nl
      • {BLOCKED}gwell.com
      • {BLOCKED}ortsequip.com
      • {BLOCKED}tion-medical.online
      • {BLOCKED}up.pt
      • {BLOCKED}storage.co.uk
      • {BLOCKED}turf.com
      • {BLOCKED}div.com
      • {BLOCKED}dkershawwines.co.za
      • {BLOCKED}dmaybury.co.uk
      • {BLOCKED}mattgarage.ch
      • {BLOCKED}mbh.com
      • {BLOCKED}angoly.com
      • {BLOCKED}usic.nl
      • {BLOCKED}katjaya.com
      • {BLOCKED}talk.com
      • {BLOCKED}pollee.com
      • {BLOCKED}hendriks.nl
      • {BLOCKED}yn.com
      • {BLOCKED}attonecase.it
      • {BLOCKED}a.com
      • {BLOCKED}mark.dk
      • {BLOCKED}igns.com
      • {BLOCKED}4.com
      • {BLOCKED}diology.com
      • {BLOCKED}tar.ch
      • {BLOCKED}tar.ch
      • {BLOCKED}e.com
      • {BLOCKED}oncrete.com
      • {BLOCKED}xtel.uk
      • {BLOCKED}nchiuk.com
      • {BLOCKED}malo-developpement.fr
      • {BLOCKED}amar.nl
      • {BLOCKED}low.com
      • {BLOCKED}toy.store
      • {BLOCKED}pics.co.uk
      • {BLOCKED}og.org
      • {BLOCKED}iznes.com
      • {BLOCKED}t.ag
      • {BLOCKED}dlair.com
      • {BLOCKED}bohrmaschinetests.com
      • {BLOCKED}sseldienste-hannover.de
      • {BLOCKED}rquotes.com
      • {BLOCKED}derschoembs.com
      • {BLOCKED}-moelln.de
      • {BLOCKED}ch.academy
      • {BLOCKED}ndsroute66.co.uk
      • {BLOCKED}inderpt.com
      • {BLOCKED}s-clubs.co.uk
      • {BLOCKED}ed-minds.de
      • {BLOCKED}ewrightway.com
      • {BLOCKED}albrightdds.com
      • {BLOCKED}alemap.com
      • {BLOCKED}sspices.com
      • {BLOCKED}ingplanet.com
      • {BLOCKED}edia.de
      • {BLOCKED}edenroth.dk
      • {BLOCKED}ght.com
      • {BLOCKED}bird.dk
      • {BLOCKED}itsolutions.ch
      • {BLOCKED}tonfinancial.com
      • site.{BLOCKED}t.com.br
      • {BLOCKED}o.org
      • {BLOCKED}ping.de
      • {BLOCKED}eper.li
      • {BLOCKED}nski.eu
      • {BLOCKED}rome.eu
      • {BLOCKED}i.fi
      • {BLOCKED}ndnutrition.co.uk
      • {BLOCKED}nner.ro
      • {BLOCKED}vents.be
      • {BLOCKED}makerszwijndrecht.nl
      • {BLOCKED}inner.com
      • {BLOCKED}rcashsystem.com
      • {BLOCKED}ind.net
      • {BLOCKED}peak.com
      • {BLOCKED}ourism.academy
      • {BLOCKED}orkplaza.com
      • {BLOCKED}okna23.ru
      • {BLOCKED}osting.nl
      • {BLOCKED}brerie.it
      • {BLOCKED}onshosting.co.uk
      • {BLOCKED}i.ch
      • {BLOCKED}e.fr
      • {BLOCKED}eeing.net
      • {BLOCKED}el.be
      • {BLOCKED}movers.com
      • {BLOCKED}udible.com
      • {BLOCKED}ltyhomeservicesllc.com
      • {BLOCKED}marketingdigital.com.br
      • {BLOCKED}rei-hannover.de
      • {BLOCKED}lo.nl
      • {BLOCKED}ats.com
      • {BLOCKED}fieldplumbermo.com
      • {BLOCKED}coach.com
      • {BLOCKED}e.com
      • {BLOCKED}isateur.fr
      • {BLOCKED}xinc.com
      • {BLOCKED}infirmier.fr
      • {BLOCKED}yqualitysystems.com
      • {BLOCKED}plive.org
      • {BLOCKED}oulis.gr
      • {BLOCKED}-n-bitch.com
      • {BLOCKED}idgemontessori.com
      • {BLOCKED}und-ansichten.de
      • {BLOCKED}hs-wanderlust.info
      • {BLOCKED}reliefadvice.com
      • {BLOCKED}nosis.academy
      • {BLOCKED}numerik.fr
      • {BLOCKED}rcy.fr
      • {BLOCKED}d.com
      • {BLOCKED}scolony.com.ng
      • {BLOCKED}artemis.gr
      • {BLOCKED}utions.es
      • {BLOCKED}joen.fi
      • {BLOCKED}arhire.co.uk
      • {BLOCKED}lberg.de
      • {BLOCKED}z.fr
      • {BLOCKED}-made.com
      • {BLOCKED}regreenapts.com
      • {BLOCKED}evries.com
      • {BLOCKED}hers.com
      • {BLOCKED}geldvergleich.de
      • {BLOCKED}k.com
      • {BLOCKED}irginia.com
      • {BLOCKED}akopieva.ru
      • {BLOCKED}kartano.fi
      • {BLOCKED}p.co.uk
      • {BLOCKED}ia-conseil.fr
      • {BLOCKED}geln.ch
      • {BLOCKED}ash.com
      • {BLOCKED}dos.com
      • {BLOCKED}nadaydentalimplants.com
      • {BLOCKED}ebell.website
      • {BLOCKED}lair.de
      • {BLOCKED}tonarim.com
      • {BLOCKED}javertailut.net
      • {BLOCKED}eleachat.fr
      • {BLOCKED}ble.pl
      • {BLOCKED}adio.de
      • {BLOCKED}can.org
      • {BLOCKED}eek-diet.net
      • {BLOCKED}question.com
      • {BLOCKED}r-lueneburg.de
      • {BLOCKED}e-embellie.fr
      • {BLOCKED}auty-guides.com
      • {BLOCKED}rdroomafrica.com
      • {BLOCKED}pboard.co.uk
      • {BLOCKED}awaycollective.com
      • {BLOCKED}nningmanmusical.com
      • {BLOCKED}ecounsellingpractice.co.uk
      • {BLOCKED}ellect.edu.pk
      • {BLOCKED}pa.com
      • {BLOCKED}elfairy.com
      • {BLOCKED}ybusinessacademy.com
      • {BLOCKED}kroadny.com
      • {BLOCKED}dio.academy
      • {BLOCKED}perez.com
      • {BLOCKED}ettyhair.com
      • {BLOCKED}echic.com
      • {BLOCKED}eke.de
      • {BLOCKED}oinsurers.net
      • {BLOCKED}esti.net
      • {BLOCKED}tuition.org
      • {BLOCKED}ackofthemoon.com
      • {BLOCKED}oot.co
      • {BLOCKED}avigator.ch
      • {BLOCKED}umacademy.com
      • {BLOCKED}are.com
      • {BLOCKED}olhealth.com
      • {BLOCKED}fer.fr
      • {BLOCKED}vl.ru
      • {BLOCKED}ete.com
      • {BLOCKED}ttabordeaux.fr
      • {BLOCKED}ttagaite.fr
      • {BLOCKED}lsguide.dk
      • {BLOCKED}g.academy
      • {BLOCKED}cks.com
      • {BLOCKED}kansenloket.nl
      • {BLOCKED}n.nu
      • {BLOCKED}ance.fr
      • {BLOCKED}mag.com
      • {BLOCKED}telifesource.com
      • {BLOCKED}herapy.site
      • {BLOCKED}oredhentaigif.com
      • {BLOCKED}ored.gr
      • {BLOCKED}w-narty.pl
      • {BLOCKED}selle.fr
      • {BLOCKED}acteur.fr
      • {BLOCKED}t-voice.com
      • {BLOCKED}o.fr
      • {BLOCKED}4.online
      • {BLOCKED}aard.dk
      • {BLOCKED}nessa.com
      • {BLOCKED}wingsdouche.nl
      • {BLOCKED}victoria.com
      • {BLOCKED}rental.ae
      • {BLOCKED}aecoturismo.com.br
      • {BLOCKED}mcosta.com
      • {BLOCKED}lhoogeveen.nl
      • {BLOCKED}biz.com
      • {BLOCKED}a.plus
      • {BLOCKED}o.com
      • {BLOCKED}rray.com
      • {BLOCKED}owersandrakes.com
      • {BLOCKED}man.es
      • {BLOCKED}erland.nl
      • {BLOCKED}ale.biz
      • {BLOCKED}5.com
      • {BLOCKED}sites.com
      • {BLOCKED}gceremonieswithtim.com
      • {BLOCKED}customers.fr
      • {BLOCKED}ugtrolley.net
      • {BLOCKED}ligenstadt.de
      • {BLOCKED}ngcrane.com
      • {BLOCKED}dgo.hu
      • {BLOCKED}ssenreden.com
      • {BLOCKED}z.pl
      • {BLOCKED}ess.idium.no
      • {BLOCKED}roskitour.com
      • {BLOCKED}zil.com
      • {BLOCKED}itute.org
      • {BLOCKED}rest.net
      • {BLOCKED}abehgab4ak0ddz.xn--p1ai
      • {BLOCKED}addfr4ahr.dp.ua
      • {BLOCKED}lligafrgpatroner-stb.se
      • {BLOCKED}inoapte-6ld.ro
      • {BLOCKED}urces.com
      • {BLOCKED}fi.com
      • {BLOCKED}a.ru
      • {BLOCKED}nprimaunggul.org
      • {BLOCKED}rysalonsoho.com:443
      • {BLOCKED}chicken.ca
      • {BLOCKED}smicbeing.com
      • {BLOCKED}ppyevents.fr
      • {BLOCKED}xtshoes.com
      • {BLOCKED}enghotel.com
      • {BLOCKED}in-aquarelles.fr
      • {BLOCKED}ana.com
      • {BLOCKED}eszczecin.pl
      • {BLOCKED}n.ae
      • {BLOCKED}k.com
      • {BLOCKED}k.com
      • {BLOCKED}k.com
      • {BLOCKED}tar.com
      • {BLOCKED}erderijravensbosch.nl
      • {BLOCKED}h-umzug.ch
      • {BLOCKED}kuyutemel.com
      • {BLOCKED}ficial.nl
      {string1}
      • wp-content
      • include
      • content
      • uploads
      • static
      • admin
      • data
      • news
      {string2}
      • images
      • pictures
      • image
      • temp
      • tmp
      • graphic
      • assets
      • pics
      • game
      {string3}
      • jpg
      • png
      • gif

ランサムウェアの不正活動

マルウェアは、ファイル名に以下の文字列を含むファイルの暗号化はしません。

  • File extension:
    • 386
    • adv
    • ani
    • bat
    • bin
    • cab
    • cmd
    • com
    • cpl
    • cur
    • deskthemepack
    • diagcab
    • diagcfg
    • diagpkg
    • dll
    • drv
    • exe
    • hlp
    • hta
    • icl
    • icns
    • ico
    • ics
    • idx
    • key
    • ldf
    • lnk
    • lock
    • mod
    • mpa
    • msc
    • msi
    • msp
    • msstyles
    • msu
    • nls
    • nomedia
    • ocx
    • prf
    • ps1
    • rom
    • rtp
    • scr
    • shs
    • spl
    • sys
    • theme
    • themepack
    • wpx
  • File name:
    • autorun.inf
    • boot.ini
    • bootfont.bin
    • bootsect.bak
    • desktop.ini
    • iconcache.db
    • ntldr
    • ntuser.dat
    • ntuser.dat.log
    • ntuser.ini
    • thumbs.db

マルウェアは、以下のフォルダ内で確認されたファイルの暗号化はしません。

  • $recycle.bin
  • $windows.~bt
  • $windows.~ws
  • appdata
  • application data
  • boot
  • google
  • intel
  • mozilla
  • msocache
  • perflogs
  • program files
  • program files (x86)
  • programdata
  • system volume information
  • tor browser
  • windows
  • windows.old

マルウェアは、暗号化されたファイルのファイル名に以下の拡張子を追加します。

  • .{random extension}

マルウェアが作成する以下のファイルは、脅迫状です。

  • {random extension}-HOW-TO-DECRYPT.txt

  対応方法

対応検索エンジン: 9.850
初回 VSAPI パターンバージョン 15.352.04
初回 VSAPI パターンリリース日 2019年9月8日
VSAPI OPR パターンバージョン 15.353.00
VSAPI OPR パターンリリース日 2019年9月9日

手順 1

トレンドマイクロの機械学習型検索は、マルウェアの存在を示す兆候が確認された時点で検出し、マルウェアが実行される前にブロックします。機械学習型検索が有効になっている場合、弊社のウイルス対策製品はこのマルウェアを以下の機械学習型検出名として検出します。

    Troj.Win32.TRX.XXPE50FFF031

手順 2

Windows XP、Windows Vista および Windows 7 のユーザは、コンピュータからマルウェアもしくはアドウェア等を完全に削除するために、ウイルス検索の実行前には必ず「システムの復元」を無効にしてください。

手順 3

このマルウェアもしくはアドウェア等の実行により、手順中に記載されたすべてのファイル、フォルダおよびレジストリキーや値がコンピュータにインストールされるとは限りません。インストールが不完全である場合の他、オペレーティングシステム（OS）の条件によりインストールがされない場合が考えられます。手順中に記載されたファイル／フォルダ／レジストリ情報が確認されない場合、該当の手順の操作は不要ですので、次の手順に進んでください。

手順 4

Windowsをセーフモードで再起動します。

[ 詳細 ]

手順 5

不明なレジストリキーを削除します。

[ 詳細 ]

警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。

  • HKEY_LOCAL_MACHINE\SOFTWARE\QtProject\OrganizationDefaults
  • HKEY_LOCAL_MACHINE\SOFTWARE\QtProject

手順 6

以下のファイルを検索し削除します。

[ 詳細 ]
コンポーネントファイルが隠しファイル属性の場合があります。[詳細設定オプション]をクリックし、[隠しファイルとフォルダの検索]のチェックボックスをオンにし、検索結果に隠しファイルとフォルダが含まれるようにしてください。
  • %User Temp%\{random}.bmp
  • {encrypted folder}\{appended random extension}-HOW-TO-DECRYPT.txt

手順 7

デスクトッププロパティを修正します。

[ 詳細 ]

手順 8

コンピュータを通常モードで再起動し、最新のバージョン（エンジン、パターンファイル）を導入したウイルス対策製品を用い、「Ransom.Win32.SODINOKIBI.AUWTL 」と検出したファイルの検索を実行してください。 検出されたファイルが、弊社ウイルス対策製品により既に駆除、隔離またはファイル削除の処理が実行された場合、ウイルスの処理は完了しており、他の削除手順は特にありません。


ご利用はいかがでしたか？　アンケートにご協力ください