Sign In with your
Trend Micro Account
需要協助?
需要協助?

若您需要技術支援,請 按此建立案件。

針對Medusa勒索病毒的解決方案和保護措施

    • 更新於:
    • 8 Jul 2021
    • 產品/版本:
    • 作業系統:
概要

MedusaLocker勒索病毒首次出現在2019年9月,主要來自垃圾郵件,並以Windows機器為目標。這種惡意軟體的行為是在執行和文件加密之前以安全模式啟動。它還使用BAT文件和PowerShell,具體取決於各種變種。通常情況下,受感染的機器在啟動時將會遇到錯誤,因為最新的變種還擴展了Bootmgr並附加了 "inprocess "。

行為

  • 刪除陰影複製和備份
  • 確保在目標機器上保持持久性
  • 禁用復原模式
  • 重新命名bootmgr 防止機器正常啟動
  • 終止程序
  • 停止服務
  • 創建Mutex
  • 安全模式下啟動

能力

  • 檔案加密
  • 停用使用率功能

影響

  • 資料遺失 - 加密後失去重要文件、檔案和其他資料
  • 經濟損失 - 用戶被要求付費以解密受影響的文件
詳情
Public

Available Solutions

檔案信譽

Detection/Policy/RulesPattern Branch/VersionRelease Date
Ransom.Win32.MEDUSALOCKER.APattern available in OPR 16.411.00Dec 13, 2020
Ransom.Win64.MEDUSALOCKER.AAPattern available in OPR 16.411.00Dec 13, 2020
Trojan.BAT.MEDUSALOCKER.AAPattern available om OPR 16.416.05Dec 13, 2020
Ransom.Win32.MEDUSALOCKER.H.notePattern available om OPR 16.410Dec 13, 2020
Trojan.PS1.COBACIS.APattern available om OPR 16.410Dec 13, 2020

Predictive Machine Learning

DetectionPattern Branch/Version
Troj.Win32.TRX.XXPE50FFF032In-the-Cloud
Troj.Win32.TRX.XXPE50FFF039In-the-Cloud

行為監控

Policy IDPattern Branch/Version
RAN4056T – Generic DEL Shadow Copy commandsBehavior Monitoring OPR 1.907

Sandbox Solution

Detection NamePattern Branch/Version
VAN_RANSOMWARESandbox Behavior

Solution Map - What should customers do?

TREND MICRO SOLUTIONSMAJOR PRODUCTSLATEST VERSIONSVIRUS PATTERNANTISPAM PATTERNNETWORK PATTERNBEHAVIOR MONITORINGPREDICTIVE MACHINE LEARNINGWEB REPUTATION
Endpoint SecurityApexOne2019Update pattern via web consoleNot ApplicableUpdate pattern via web consoleEnable Behavior Monitoring and update pattern via web consoleEnable Predictive Machine LearningEnable Web Reputation Service and update pattern via web console
OfficeScanXG (12.0)Not Applicable
Worry-Free Business SecurityStandard (10.0)
Advanced (10.0)Update pattern via web console
Hybrid Cloud SecurityDeep Security12.0Update pattern via web consoleNot ApplicableUpdate pattern via web consoleEnable Behavior Monitoring and update pattern via web consoleEnable Predictive Machine LearningEnable Web Reputation Service and update pattern via web console
Email and Gateway SecurityDeep Discovery Email Inspector3.5Update pattern via web consoleUpdate pattern via web consoleUpdate pattern via web consoleNot ApplicableNot ApplicableEnable Web Reputation Service and update pattern via web console
InterScan Messaging Security9.1Not Applicable
InterScan Web Security6.5
ScanMail for Microsoft Exchange14.0
Network SecurityDeep Discovery Inspector5.5Update pattern via web consoleNot ApplicableUpdate pattern via web consoleNot ApplicableNot ApplicableEnable Web Reputation Service and update pattern via web console

建議

Threat Report

Premium
Internal
Partner
評價:
分類:
解決方案ID:
000283372
評定這個解決方案
本文是否幫助解決您的問題?

感謝您的意見!


本意見調查系統為自動運作,將不會回覆如銷售、技術、產品等一般問題.

若您需要協助,請聯繫對應的技術支援窗口. 聯絡我們


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.