AstraLocker v2.0 Ransomware (.AstraLocker)

[jasonX]

AstraLocker v2.0 Ransomware (.AstraLocker) (2025. 01. 18. 434)

 

AppCheck Anti-Ransomware : AstraLocker v2.0 Ransomware (.AstraLocker) Block Video

Distribution Method : Unknown
 
MD5 : 8db7d5fb5cbdfc0731978261639f01a6
 
Major Detection Name : Ransom:Win32/Babuk.MAK!MTB (Microsoft), Ransom.Win32.BABUK.SMRD1 (Trend Micro)
 
Encrypted File Pattern : .AstraLocker
 
Payment Instruction File : Recover_Your_Files.html
 
Major Characteristics :
 

• Offline Encryption
  
• Babuk Locker / ChiChi Locker / DARKY LOCK / Delta Plus / Pandora / RA Group / Rook Ransomware series
  
• Recovery Partition (M:\) + EFI System Partition (N:\) drives are activate.
  
• Block processes execution (excel.exe, firefox.exe, oracle.exe, sql.exe, synctime.exe, thebat.exe etc.)
  
• Stop multi services (backup, DefWatch, GxFWD, QBFCService, sophos, veeam etc.)
  
• Disable system restore (vssadmin.exe delete shadows /all /quiet)
  

More Info HERE

Content lifted from CheckMAL site with permission