Detect Date 11/20/2015
Class Trojan-Ransom
Platform Win32

This family of Trojans blocks the user’s computer and requests a ransom for restoring its functionality.

The program adds itself to the list of programs launched automatically after the operating system loads, limits access to the desktop, and hides the windows of the Windows Task Manager and system controls, such as the taskbar and Start menu.

Geographical distribution of attacks by the Trojan-Ransom.Win32.Foreign family


Geographical distribution of detections during the period from 20 November 2014 to 20 November 2015

Top 10 countries with most attacked users (% of total attacks)

Country % of users attacked worldwide*
1 Russian Federation 19.44
2 Italy 13.44
3 Germany 9.00
4 Austria 5.37
5 India 4.93
6 USA 3.63
7 Vietnam 3.10
8 Ukraine 2.72
9 Brazil 1.97
10 Kazakhstan 1.90

* Percentage of all unique Kaspersky users attacked by this malware

Find out the statistics of the threats spreading in your region