This trojan blocker ( MD5: 9a6f87b4be79d0090944c198a68012b6 ) prevents all software execution.
To remove the Trojan (and unlock windows), infected users need to enter a valid serial number.
According to VirusTotal, the sample is detected by just 3 Antivirus ~ https://www.virustotal.com/file-scan/report.html?id=39962ce4ed55bc96cd9857928d41357b0152ee3f22e2e9afc8d77788686f1299-1299783978
This Ransomware is distributed with fake update site or share site.
here in French, Fake firefox update (Firefox_update.exe):
Firefox explorer:
Fake google sharing (file35820289892.exe):
Fake scanner page (WindowsWebSecurity.exe):
Who is really failed:
Ransomware downloaded:
Number to Call: 00261221000183 ~ +261221000183
Number to Call: 002392216469 ~ +2392216469
Number to Call: 002392216464 ~ +2392216464
Number to Call: 00261221000181 ~ +261221000181
Number to Call: 00881935211841 ~ +881935211841
Number to Call: 0088213090406 ~ +88213090406
Number to Call: 002392216368 ~ +2392216368
Number to Call: 004525970180 ~ +4525970180
Code to unlock Windows: 1351236
