- Distribution Method : Unknown
- MD5 : d4c9f9e79018313581b3a0275e97d95a
- Major Detection Name : Trojan.Encoder.567 (Dr.Web), Ransom_CRYPICH.F116G5 (Trend Micro)
- Encrypted File Pattern : email-cryptolocker@aol.com.ver-CL 1.0.0.0.u.id-<Random>-<Month>@<Day>@<Year> <Hour>@<Minute>@<Second> <AM/PM><Random>@@@@@<Random>-<Random>.randomname-<Random>.<Random>.cbf
- Malicious File Creation Location :
- C:\Program Files (x86)\<Random>.exe
- C:\Users\%UserName%\AppData\Local\Temp\<Random>.exe
- Major Characteristics :
- Offline Encryption
- The Russian users targeted
- Changes desktop background (C:\Users\%UserName%\AppData\Local\Temp\desk.bmp)
List