Once the files are encrypted using AES-256 and RSA-2048 algorithms the original files are deleted while the encrypted ones start bearing a ".HakunaMatata" extension (hence the name). It is known to delete the shadow copies in order to make file recovery harder. It uses the following commands upon launch: Files associated with this ransomware: * Recovers files yako.html * .exe * .tmp * crypter_191_.exe * net1.exe * wevtutil.exe
| Attributes | Values |
|---|---|
| rdf:type | |
| rdfs:label |
|
| rdfs:comment |
|
| dcterms:subject | |
| dbkwik:malware/pro...iPageUsesTemplate | |
| Platform |
|
| Name |
|
| Type |
|
| filetype |
|
| abstract |
|