Bart

Old ! but still not cleaned :'(

Is the infection vector for this one known?

I only saw it on server with rdp and with backdoored website... So difficult to be sure but I would say 'via rdp'

Sounds very plausible, added to the ransomware overview. These ones are harder to track the origin from.

but it is "an old" ransomware, first view was in 2k13, (they did some change since, but without sample, I can't be sure)

Yep, quite a lot of mentions on Russian forums, but very hard to track a sample :( Thanks mate!

I vote for RDP/VNC bruteforce for vector. For a sample, check: https://www.virustotal.com/en/file/5f62090baf4012f9d93aa7948a09f777d739138c23b58928b4e11274e3d78ba1/analysis/ …

Looks like a decoder, not the ransomware :/