Ransomware information on Jul. 22, 2016

- File : email ID_E76DB.zip

email ID_2161.zip
email ID_1BB2C.zip
4B73B_email ID.zip

- Content : INV000 5cbd.js
AT00065AA.wsf
INV000 701.js
INV000 7cb2.js

- Process : C:/Users Account name/AppData/Local/Temp/tKnJ5B7b9.exe

C:/Users Account name/AppData/Local/Temp/Nc4uhjKNhLIbzucZ.exe
C:/Users Account name/AppData/Local/Temp/syDWZqJJQI13HdH.exe
C:/Users Account name/AppData/Local/Temp/Bn5TMCxzvZbJrmYT.exe

- It is possible to real-time block by TrojanCut.

- Remarks : C&C Server was changed on every attack.