- Distribution Method : Remote access through Remote Desktop Protocol(RDP) or Terminal Services
- MD5 : 41acc186c5955a7495898a09f2b3484b
- Major Detection Name : Ransom:Win32/Vcrypt (Microsoft), Ransom.Tox (Norton)
- Encrypted File Pattern : .velso
- Malicious File Creation Location : C:\Users\%UserName%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\get_my_files.txt
- Payment Instruction File : get_my_files.txt
- Major Characteristics : Offline Encryption
List