- Distribution Method : Mail attachment
- MD5 : f077b41c0c28c982d0ded24536bff9b0
- Major Detection Name : Trojan.Ransom.LockyCrypt (ALYac), Ransom:Win32/Ergop.A (Microsoft)
- Encrypted File Pattern : .911
- Malicious File Creation Location :
- C:\Users\%UserName%\AppData\Local\Temp\<Random>.exe
- C:\Users\Public\<Random>.exe
- Payment Instruction File : READ_IT.html
- Major Characteristics :
- Offline Encryption
- Fake Globe / PSCrypt Ransomware series
- Use a valid "Northcat Ltd" Digital Signatures
- Disable system restore (vssadmin.exe Delete Shadows /All /Quiet)
List