Search
Keyword: microsoft internet explorer
64bit) victim ID Ransom:Win32/Locky (Microsoft); Downloaded from the Internet Connects to URLs/IPs, Steals information, Encrypts files, Displays message/message boxes
have rootkit capabilities. It does not exploit any vulnerability. Ransom.Locky (Symantec), Ransom:Win32/Locky.A (Microsoft), Trojan-Ransom.Win32.Locky.bom (Kaspersky) Downloaded from the Internet
(Symantec) Downloaded from the Internet Connects to URLs/IPs, Encrypts files, Displays message/message boxes, Steals information
(Symantec) Downloaded from the Internet Connects to URLs/IPs, Encrypts files, Displays message/message boxes, Steals information
(Symantec) Downloaded from the Internet Connects to URLs/IPs, Displays message/message boxes, Steals information, Encrypts files
Downloaded from the Internet Connects to URLs/IPs, Steals information, Encrypts files, Displays message/message boxes
Ransom:Win32/Locky (Microsoft) Downloaded from the Internet Connects to URLs/IPs, Encrypts files, Displays message/message boxes, Steals information
number of encrypted files OS architecture (if 64bit) victim ID Ransom:Win32/Locky!rfn (Microsoft); Ransom.Locky (Malwarebytes); Trojan.Cryptolocker.AF (Symantec) Downloaded from the Internet Connects to
Internet Connects to URLs/IPs, Encrypts files, Displays message/message boxes, Steals information
window containing the ransom message: The dropped ransom note contains the same ransom message: Trojan:Win32/Dynamer!ac (Microsoft), a variant of Win32/Injector.CPGP (ESET) Downloaded from the Internet
Downloaded from the Internet Connects to URLs/IPs, Encrypts files
decryption key, it displays the following message boxes: Trojan.MalPack.AI (Malwarebytes), Ransom:Win32/Genasom (Microsoft) Dropped by other malware, Downloaded from the Internet Displays message/message
by other malware, Downloaded from the Internet Terminates processes, Encrypts files
Center\Svc UacDisableNotify = "1" HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Internet Settings GlobalUserOffline = "0" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion
Microsoft : Trojan:Win32/Bamital; Norman : Trojan TXT/Bamital.A
startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows NT\CurrentVersion\Winlogon\ Notify\msadcr Logon = "WlDimsStartup" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows NT\CurrentVersion\Winlogon\ Notify
\SOFTWARE\Microsoft\ Cryptography It adds the following registry entries: HKEY_CURRENT_USER\Software\Microsoft\ Cryptography MachineGuid = "b12fd369-3201-41e8-8195-285bddf2fba7" Other Details This Trojan
\SOFTWARE\Microsoft\ Cryptography It adds the following registry entries: HKEY_CURRENT_USER\Software\Microsoft\ Cryptography MachineGuid = "c0ec5f52-5916-4734-b775-de16d05385c3" Other Details This Trojan
execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run S131630 = "{malware path and file name}" Other System Modifications This Trojan adds the following registry
\SOFTWARE\Microsoft\ Cryptography It adds the following registry entries: HKEY_CURRENT_USER\Software\Microsoft\ Cryptography MachineGuid = "3f8a5e8a-4338-4c8d-aa7a-8f00d369feae" Other Details This Trojan