+- Geeks for your information (https://www.geeks.fyi)
+-- Forum: Security (https://www.geeks.fyi/forumdisplay.php?fid=68)
+--- Forum: Security Vendors (https://www.geeks.fyi/forumdisplay.php?fid=87)
+---- Forum: CheckMAL (https://www.geeks.fyi/forumdisplay.php?fid=96)
+----- Forum: CheckMAL Videos (https://www.geeks.fyi/forumdisplay.php?fid=161)
+----- Thread: AstraLocker v2.0 Ransomware (.AstraLocker) (/showthread.php?tid=20529)
AstraLocker v2.0 Ransomware (.AstraLocker) - jasonX - 27 January 25
AstraLocker v2.0 Ransomware (.AstraLocker) (2025. 01. 18. 434)
AppCheck Anti-Ransomware : AstraLocker v2.0 Ransomware (.AstraLocker) Block Video
Distribution Method : Unknown
MD5 : 8db7d5fb5cbdfc0731978261639f01a6
Major Detection Name : Ransom:Win32/Babuk.MAK!MTB (Microsoft), Ransom.Win32.BABUK.SMRD1 (Trend Micro)
Encrypted File Pattern : .AstraLocker
Payment Instruction File : Recover_Your_Files.html
Major Characteristics :
- Offline Encryption
- Babuk Locker / ChiChi Locker / DARKY LOCK / Delta Plus / Pandora / RA Group / Rook Ransomware series
- Recovery Partition (M:\) + EFI System Partition (N:\) drives are activate.
- Block processes execution (excel.exe, firefox.exe, oracle.exe, sql.exe, synctime.exe, thebat.exe etc.)
- Stop multi services (backup, DefWatch, GxFWD, QBFCService, sophos, veeam etc.)
- Disable system restore (vssadmin.exe delete shadows /all /quiet)
More Info HERE
Content lifted from CheckMAL site with permission