HackTool.MSIL.Povlsomware.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Otros detalles

Hace lo siguiente:

• retrieves key used by Povlsomware in file encryption by:
  • obtaining the file path of ransomware binary by reading the following key set as its autostart technique:
     HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
     Povlsomware = {File path of binary}
  • displays the key in console and copies it to clipboard
    
• accepts file/s as arguments and uses retrieved key to either encrypt (E) or decrypt (D) specified files:
  
  • if E is chosen:
  • encrypts a copy of the file and drops it to current directory
  • renames the file into the following:
  • {original filename}_povlsom_crypt.{original file extension}
  • if D is chosen:
  • decrypts a copy of the encrypted file and drops it to current directory
  • renames the file into the following:
  • {original filename}_povlsom_decrypt.{original file extension}