- Distribution Method : Unknown
- MD5 : 367d334e2fb8c5a215574a674582d2ad
- Major Detection Name : Trojan-Ransom.Win32.Crypren.adsz (Kaspersky), Ransom:Win32/FileCryptor (Microsoft)
- Encrypted File Pattern : .lock → No Change
- Malicious File Creation Location : C:\Users\%UserName%\AppData\Roaming\<Random>.exe
- Major Characteristics :
- Offline Encryption
- Encrypts .dll, .exe and other files in "C:\Program Files\Common Files" or "C:\Program Files (x86)\Common Files"
List