- Distribution Method : Unknown
- MD5 : 2591533887b08d36ffebc9bd56fc91d3
- Major Detection Name : Trojan-Ransom.Win32.CryFile.bmy (Kaspersky), Ransom_FILL.A (Trend Micro)
- Encrypted File Pattern : .corrupt
- Malicious File Creation Location :
- C:\exportKey
- C:\exportKey\DECRYPTKEY
- <Drive Letter>:\fill\fill0
- Payment Instruction File : <Original Filename>.<Original Extension>.acryhjccbb@protonmail.com
- Major Characteristics :
- Offline Encryption
- Creat a large file (\\fill\fill0) to fill disk free space
List