- Distribution Method : Unknown
- MD5 : af568e8a6060812f040f0cb0fd6f5a7b
- Major Detection Name : Win32:HelloKitty-A [Ransom] (Avast), W32/DeathRansom.C!tr.ransom (Fortinet)
- Encrypted File Pattern : .crypted
- Payment Instruction File : read_me_lkd.txt
- Major Characteristics :
- Offline Encryption
- DeathRansom / FiveHands Ransomware series
- Block processes execution (dsa*, IBM*, mysql*, Ntrtscan, robo*, TmListen etc.)
- Stop multi services (mr2kserv, MSExchangeIS, MSSQLServerADHelper100, ReportServer$ISARS, SPTimerV4, SQLAgent$ISARS etc.)
List