- Distribution Method : Access using Remote Desktop Protocol (RDP) or a remote program.
- MD5 : d70e82645b7f47adbcdddcb1f363afb1
- Major Detection Name : Ransomware/Win.BTCAZADI.R593934 (AhnLab V3), Trojan:Win32/Filecoder.ARA!MTB (Microsoft)
- Encrypted File Pattern : .EMAIL=[azadi33@smime.ninja]ID=[<Random>].BTC
- Message File : How To Restore Files.txt
- Major Characteristics :
- Offline Encryption
- Fast / Harward / Kasper / Tesla Ransomware series
- Disable system restore (vssadmin.exe delete shadows /all /quiet)
List