- Distribution Method : Remote access through Remote Desktop Protocol(RDP) or Terminal Services
- MD5 : 29b0ce63028ca8c6ad64ead00eadff69
- Major Detection Name : Generic.Ransom.DMR.A7AAA609 (BitDefender), Ransom.Win32.CLOWN.D (Trend Micro)
- Encrypted File Pattern : [Heeeh98@tutanota.com][id=<Random>]<Original Filename>.<Original Extension>.notfound
- Malicious File Creation Location : C:\\!!! READ THIS !!!.hta
- Payment Instruction File : !!! READ THIS !!!.hta / HOW TO RECOVER ENCRYPTED FILES.txt
- Major Characteristics : BigBobRoss / TheDMR Ransomware series
List