Search

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It is capable of encrypting files in the affected

%User Temp%\svchost.exe - This is deleted after encryption of all files (Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on

encryption of files (Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32-

%User Temp%\svchost.exe - This is deleted after encryption of all files (Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on

%User Temp%\svchost.exe - This is deleted after encryption of all files (Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on

them: %User Temp%\svchost.exe - This is deleted after encryption of files (Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp

%User Temp%\svchost.exe - This is deleted after encryption of all files (Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on

not on the exclusion list. It avoids encrypting files with the following file extensions: .exe .dll .lnk .sys .msi .bat .LOCK3D It encrypts files using the following encryption methods: Full Encryption:

version -d → Will not delete itslef after execution -f → Exclude system folder from encryption -i {File path} → Encrypts specified folder -k {File path} → Loads key from the mentioned file -n → Uses network

This Backdoor does the following: It is capable of file encryption Encryption Key: "lolomycin2017" It uses several Anti Virtualization techniques: Searches for any additional tools used by the Hypervisor

Description Name: JBOSS JMX CONSOLE FILE DEPLOYER EXPLOIT - HTTP (Request) . This is Trend Micro detection for HTTP network protocol that manifests exploit activities and can be used for Point of Entry or Lateral Movement.The host exhibiting this ty...

Description Name: CVE-2019-5418 - RUBY ON RAILS - FILE CONTENT DISCLOSURE - HTTP (Request) . This is Trend Micro detection for HTTP network protocol that manifests exploit activities and can be used for Point of Entry.The host exhibiting this type o...

Description Name: CVE-2018-18778 - ACME File Discovery Exploit - HTTP (RESPONSE) . This is Trend Micro detection for HTTP network protocol that manifests exploit activities and can be used for Point of Entry or Lateral Movement.The host exhibiting th...

Description Name: Suspicious Cgi Arbitrary File Upload - HTTP (Request) . This is Trend Micro detection for HTTP network protocol that manifests exploit activities and can be used for Point of Entry or Lateral Movement.The host exhibiting this type o...

Description Name: CVE-2019-2618 - WEBLOGIC FILE UPLOAD EXPLOIT - HTTP (REQUEST) . This is Trend Micro detection for HTTP network protocol that manifests exploit activities and can be used for Point of Entry or Lateral Movement.The host exhibiting th...

Description Name: APACHE FLINK FILE UPLOAD EXPLOIT - HTTP (REQUEST) . This is Trend Micro detection for HTTP network protocol that manifests exploit activities and can be used for Point of Entry or Lateral Movement.The host exhibiting this type of ne...

Description Name: Suspicious File Upload - HTTP (Request) . This is Trend Micro detection for HTTP network protocol that manifests exploit activities and can be used for Point of Entry or Lateral Movement.The host exhibiting this type of network beha...

Description Name: CVE-2017-11357 TELERIK File Upload Exploit - HTTP (Request) . This is Trend Micro detection for HTTP network protocol that manifests exploit activities and can be used for Point of Entry.The host exhibiting this type of network beha...

Description Name: KindEditor Possible WebShell File Upload Exploit - HTTP (Request) . This is Trend Micro detection for HTTP network protocol that manifests exploit activities and can be used for Point of Entry.The host exhibiting this type of networ...

Description Name: TMMS FILE DISCLOSURE EXPLOIT - HTTP (Request) . This is Trend Micro detection for HTTP network protocol that manifests exploit activities and can be used for Point of Entry.The host exhibiting this type of network behavior is likely...