About: dbkwik:resource/Ltw_3n9m-Tsny4C5K5m-dg==

Property	Value
rdf:type	Malware
rdfs:label	HakunaMatata
rdfs:comment	Once the files are encrypted using AES-256 and RSA-2048 algorithms the original files are deleted while the encrypted ones start bearing a ".HakunaMatata" extension (hence the name). It is known to delete the shadow copies in order to make file recovery harder. It uses the following commands upon launch: Files associated with this ransomware: * Recovers files yako.html * .exe * .tmp * crypter_191_.exe * net1.exe * wevtutil.exe
dcterms:subject	Win32 Ransomware Win32 ransomware
dbkwik:malware/property/wikiPageUsesTemplate	dbkwik:resource/Cteci1yq58wDC25geOK15A== dbkwik:resource/JZK7RwE-9uTp7P-hk7qJrA== dbkwik:resource/YaiKYI3zY78PgDBgR4i4Qw==
Platform	Microsoft Windows
Name	HakunaMatata / NMoreira 2.0
Type	Ransomware
filetype	.EXE
abstract	Once the files are encrypted using AES-256 and RSA-2048 algorithms the original files are deleted while the encrypted ones start bearing a ".HakunaMatata" extension (hence the name). It is known to delete the shadow copies in order to make file recovery harder. It uses the following commands upon launch: Files associated with this ransomware: * Recovers files yako.html * .exe * .tmp * crypter_191_.exe * net1.exe * wevtutil.exe