- Distribution Method : Unknown
- MD5 : c30b770ed4e60beb23972392af2be97e
- Major Detection Name : AutoIt:Ransom-L [Trj] (Avast), Ransom.Microcop (Malwarebytes)
- Encrypted File Pattern : Lock.<Original Filename>.<Original Extension>
- Malicious File Creation Location :
- C:\Users\%UserName%\AppData\Local\Temp\8x8x8
- C:\Users\%UserName%\AppData\Local\Temp\x.exe
- Major Characteristics :
- Offline Encryption
- Desktop / Encephalitis / GrodexCrypt / Lecitricic Lycor / MicroCop / Zuahahhah Ransomware series
- AutoIt scripts based Ransomware
- Kill a web browser processes (chrome.exe, firefox.exe, iexplore.exe, opera.exe, tor.exe) and Block Skype processes execution.
- Changes desktop background (C:\Users\%UserName%\AppData\Local\Temp\wl.jpg)
List