- Distribution Method : Unknown
- MD5 : 75795c8ef2b35b12e73305c32b010e84
- Major Detection Name : Generic.Ransom.Everbe.00FE913A (BitDefender), Ransom-O.k (McAfee)
- Encrypted File Pattern : .[yoursalvations@protonmail.ch].neverdies@tutanota.com
- Payment Instruction File : !=How_recovery_files=!.html
- Major Characteristics :
- Offline Encryption
- Embrace / Evil Locker / PainLocker Ransomware series
- Block processes execution (fdhost.exe, MsDtsSrvr.exe, oracle.exe, ReportingServecesService.exe, sqlserv.exe, sqlwriter.exe etc.)
- Disable system restore (vssadmin delete shadows /all /quiet)
List