• Distribution Method : Unknown

• MD5 : 589417ad5b436baf8678456640d5ae85

• Major Detection Name : RDN/Ransom (McAfee), Ransom/W32.Crypren.642048 (nProtect)

• Encrypted File Pattern : .-opentoyou@india.com

• Malicious File Creation Location :

    - C:\Logs\1.bmp
    - C:\Logs\1.jpg
    - C:\Logs\AllFilesList.ini
    - C:\Logs\Log.ansi.txt
    - C:\Logs\Log.UTF-16LE.txt

• Payment Instruction File : !!!.txt

• Major Characteristics : 오프라인 암호화(Offline Encryption), 바탕 화면 배경(C:\Logs\1.bmp) 변경, 복호화 도구 공개(https://decrypter.emsisoft.com/opentoyou)

• Reference : http://blog.emsisoft.com/2016/12/30/emsisoft-releases-free-decrypter-for-opentoyou-ransomware