- Distribution Method : Unknown
- MD5 : b226803ac5a68cd86ecb7c0c6c4e9d00
- Major Detection Name : Ransom.FileLocker (Malwarebytes), Ransom.MSIL.FUNICORN.A (Trend Micro)
- Encrypted File Pattern : .fuckunicornhtrhrtjrjy
- Malicious File Creation Location :
- C:\%UserName%
- C:\%UserName%\Rand123
- C:\%UserName%\Rand123\local.exe
- Payment Instruction File : READ_IT.txt
- Major Characteristics :
- Offline Encryption
- AnonCrack / Balbaz / Brazilian / CryBrazil / Cryp70n1c Army / Curumim / CyberPolice / EyLamo / Jhash / Magic / OpsVenezuela / Skull HT / Technicy / ZorgoCry Ransomware series
- Hidden-Tear Open Source based Ransomware
- The Italian users are targeted.
- Changes desktop background (C:\%UserName%\ransom.jpg)
List