“The ransomware accepts multiple command-line arguments that control the encryption process, such as whether to encrypt network and local drives or specific directories and files,” Check Point added.
Additionally, as per VanHelsing’s advertisement screenshot shared with the Check Point blog post, the RaaS offers other affiliate-friendly features including encryption control, encryption modes, self-propagation, and debugging.
While new affiliates are required to pay a deposit of $5,000 to gain access to the program, experienced ones can join for free. “After two blockchain confirmations of the victim’s ransom payment, the affiliates receive 80% of the revenue, while the remaining 20% is paid to the RaaS operators,” CheckPoint added.