• Distribution Method : Unknown

• MD5 : cff3ad7ffa9ab21dbae82b1f1bfa16fd

• Major Detection Name : Ransom:Win32/Tescrypt.C (Microsoft), Trojan.Cryptolocker.N (Norton)

• Encrypted File Pattern : .abc

• Malicious File Creation Location :

    - C:\Users\%UserName%\AppData\Roaming\(Random).exe
    - C:\Users\%UserName%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\howto_recover_files_(Random).html
    - C:\Users\%UserName%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\howto_recover_files_(Random).txt
    - C:\Users\%UserName%\Documents\recover_file_(Random).txt

• Payment Instruction File : howto_recover_files_(Random).html / howto_recover_files_(Random).txt

• Major Characteristics : 오프라인 암호화(Offline Encryption)