- Distribution Method : Camouflage to Minecraft Installer
- MD5 : 7083de4397b81eca6d1900133700e89c
- Major Detection Name : Trojan.Ransom.LMAOxUS (ALYac), Ransom.Gen (Norton)
- Encrypted File Pattern : .lmao
- Malicious File Creation Location :
- C:\Users\%UserName%\AppData\Local\Temp\lmaoxus.exe
- C:\Users\%UserName%\AppData\Local\Temp\MinecraftLauncher.exe (includes valid digital codesign signature of "Mojang AB" - Normal)
- Payment Instruction File : LMAO_READ_ME.txt
- Major Characteristics : EDA2 / Stolich Open source based Ransomware, Changes Desktop background(C:\Users\%UserName%\ransom.jpg)
List