Remove CMS Remove Encryption Remove File names Remove Mining
article thumbnail

The Long Run of Shade Ransomware

Security Affairs

The phishing email contains a.zip file named “slavneft.zakaz.zip”, which means something like “slavneft order” in English, showing a direct reference to “Slavneft”. It contains a russian speaking JavaScript file named “«??? «??? «?????????» ??????????? ??????”, Background of the infected machine, after encryption phase.