- Distribution Method : Unknown
- MD5 : 2bbff2111232d73a93cd435300d0a07e
- Major Detection Name : Trojan.Ransom.Snatch (ALYac), Ransom:MacOS/Filecoder (Microsoft)
- Encrypted File Pattern : .gdjlosvtnib
- Malicious File Creation Location : C:\Users\%UserName%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO RESTORE YOUR FILES.TXT
- Payment Instruction File : HOW TO RESTORE YOUR FILES.TXT
- Major Characteristics :
- Offline Encryption
- Disable system restore (vssadmin delete shadows /all /quiet)
List