- Distribution Method : Unknown
- MD5 : 390f8554f4dce775a22e2d3b5f7aa437
- Major Detection Name : Ransom.GusCrypter (Malwarebytes), Trojan.MSIL.JESMROW.AA.tmsr (Trend Micro)
- Encrypted File Pattern : .JSWORM
- Malicious File Creation Location :
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\JSWORM-DECRYPT.html
- C:\Users\%UserName%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JSWORM-DECRYPT.html
- Payment Instruction File : JSWORM-DECRYPT.html
List