Overview

overview

10

Static

static

8

ransomware.exe

windows7_x64

10

ransomware.exe

windows10_x64

10

Resubmissions

31/08/2026, 00:29

260831-atbx8avvgw10

03/08/2020, 14:59

200803-bktwtzlfze10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ransomware
  • Size 5.7MB
  • Sample200803-bktwtzlfze
  • SHA256 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64
  • MD5 SHA1 SHA512
Score
10/10
deathransomransomwarevmprotect

Malware Config

Extracted

Path

  • C:\Documents and Settings\read_me.txt

  • deathransom

Ransom Note
  • --= DEATHRANSOM =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email [email protected] [email protected] Your LOCK-ID: 8zYanJ5G8TBffvdKgLC2ws+4L+6+OfLep34sb2aFrnajCBMZvKOkt+kBPMcKFN1Gv1T0U9gR6DCcGzha1DWnsv1SI3QNwsXCrKBD0ilV6HZ76sOgjd87fBTbJgAZJzG1p4OBffNOi65PZvAZUBK5qCMivWkXFi8S5AnptHAtDTI8DmxiCiVR2Dvdw1N2XmcBzEQzpmN+V3nov/HWTvtmiqospVq03AawcSIuElq047UGtGaA4LcvzDKe0ivrQ24+nfc35NRYBGQbQvlNjzQSox23xFPtfewxrpecUyONmpzJhcE1He1/xMHMZgnB0tZ0HP3M55bJnAsPM79yyDA9C2vuOr6qgDb0H5ye/63IArTiWz5gWDwNai6Wq0Ddhr1fOaHbYVOM8SCwhHho7WTb7iwzHifb2f+/Tac+F2HhHAbH5JKaaaDO9fJe3AfPFXIRPKZc1f4gNx956G40ZqNfWF3DaIvKvwO1Hc5eE6kw+x1UUti64v/6/sxOBZfhPZt96Upo/I+o0TZZ+mvlUIgLTopz0XEqfG26zGkKOE+kcSgJrxd9Sbe2PMJVfprn2PO6fQk0/IcGV8JoUzfi0mzsx6W33ULPdbwbeH7aoyqy1gkWWJB3iN2/wPURsgUI5uiv0b9eiPpKfSjahYzDdVXqpisittni9W/HCN/BVAJV+fX3mjJLvP1LSiGlaxCYVA4OWI0bKuikAtNXVASeRdXR1g== >>>How to obtain bitcoin: The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ >>> Free decryption as guarantee! Before paying you send us up to 1 file for free decryption. We recommeded to send pictures, text files, sheets, etc. (files no more than 1mb) IN ORDER TO PREVENT DATA DAMAGE: 1. Do not rename encrypted files. 2. Do not try to decrypt your data using third party software, it may cause permanent data loss. 3. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Extracted

Path

  • C:\Boot\bg-BG\read_me.txt

  • deathransom

Ransom Note
  • --= DEATHRANSOM =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email [email protected] [email protected] Your LOCK-ID: D05wnNlkB6/ezE4kMPAASUVHuU9t8yZ5ipeXP8ls4zeyEkHnweCMMFlYtXDY+VLBChWVQ7mk4Yzk+8Dzsg6UYvU30EssDXmDLNvwH7PpEqLcx6jkbQhaFL0WHLQxJfFburTwWJNZ1HMQ6evoPU8U1mHZwmqYe/Oe0HLtTFDe7I9+kcA3CuVkLwDrBn6NCCywkGzd3IWaINMRrj1hQpXDPsFDeGXyvLrKRmpYiMbSDlJhWcVBtP7NS3YuX5+ARHjhk+UA4J6m4cf0plAYreOcyIumxL/JJZSeL7030KbCjHC+uPRM5bfMpVyO/n3XlvhlzDzxfGMiCrZzRcgIMosinZPhklbvPIzCb1m6wTrlmDubghc0NJfFxsfojHjWvOxhfOFh+P+PdaTfOeeZNr0aJt8ZoBMSMGNMBj6o3wwXuVgLcavuKWQoM37DpN6AwvY2q8hj5NkkWPbH91tV5AhEzyRJ0UHnZF3LSgOWX3etxLYrL0dAlGB65Awmre2a7Oi4oUuA3xUhvflcOmP3PZVi77doOXg1Ben3QZowZXSWfvAHJNL+qLRVOd8Qi6VnYWtSJPx4sUZ4lcsrbcoD9pXG8FcE8RoZbkAQz4g6BwlR98Yca/jg7DVNVDA7I4Tl/NMv8mwAlcnArPZlR8ByyDaBI8ANqjMdkat7AR/HUa7aYWMiW1YZ9Sa9wEHfPgkUpchX2N+TFk09dNO+6q3gcRvexw== >>>How to obtain bitcoin: The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ >>> Free decryption as guarantee! Before paying you send us up to 1 file for free decryption. We recommeded to send pictures, text files, sheets, etc. (files no more than 1mb) IN ORDER TO PREVENT DATA DAMAGE: 1. Do not rename encrypted files. 2. Do not try to decrypt your data using third party software, it may cause permanent data loss. 3. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Targets

    • Target
      ransomware
    • Size 5.7MB
    • SHA256 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64
    • MD5 SHA1 SHA512
    Score
    10/10
    ransomwaredeathransom

    • DeathRansom

      Ransomware family first seen at the start of 2020. Initial versions did not actually encrypt files.

      ransomwaredeathransom

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Drops desktop.ini file(s)

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks