- Distribution Method : Unknown
- MD5 : 235b4fa8b8525f0a09e0c815dfc617d3
- Major Detection Name : Gen:Variant.Ransom.Blind.1 (BitDefender), Ransom_BLIND.B (Trend Micro)
- Encrypted File Pattern : .[supp01@airmail.cc].napoleon
- Payment Instrucition File : How_Decrypt_Files.hta
- Major Characteristics :
- Offline Encryption
- Block processes execution (oracle.exe, sqlservr.exe)
- Disable system restore (vssadmin.exe Delete Shadows /All /Quiet)
List