- Distribution Method : Unknown
- MD5 : 8fe7bfef6ebc53e9047561d35555cd24
- Major Detection Name : Trojan/Win32.ContiRansom.R358495 (AhnLab V3), Win32/Filecoder.Conti.F (ESET)
- Encrypted File Pattern : .KCWTT
- Payment Instruction File : readme.txt
- Major Characteristics :
- Offline Encryption
- Disable system restore (WMIC.exe shadowcopy where "ID='{GUID}'" delete)
List