Detect Date 02/25/2016
Class Trojan-Ransom
Platform Win32

Malware in this family is distributed in various ways, such as attacks exploiting weak or stolen RDP credentials, and malicious attachments in spam email messages. After the malware is launched, it tries to stop some processes and turn off anti-malware software. After this step, it encrypts almost all files on all logical drives by using the AES cipher.

Top 10 countries with most attacked users (% of total attacks)

  Country Percentage of users*
1 Russian Federation 28.84
2 Brazil 9.28
3 India 4.32
4 China 2.72
5 Italy 2.61
6 Japan 2.50
7 Vietnam 2.34
8 Mexico 2.15
9 Ukraine 2.12
10 Spain 2.01

* Percentage of all unique Kaspersky users worldwide who have been attacked by this malware

Find out the statistics of the threats spreading in your region