General
-
Target
ransomware
-
Size
5.7MB
-
Sample
200803-bktwtzlfze
-
MD5
e3204b2e61223989b1562f5dee40eee0
-
SHA1
7bd50a3b0e3f9b4a543f750869ca3ee29b4798e1
-
SHA256
1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64
-
SHA512
19df0eb4c803e6eeb41abb1fb425f4d9cd6e4262aaeb8bbf7eb959a30f3db2533fd6aed13e055a9781371e9de37de4212d80a32862798368e5dd798763012bc4
Static task
static1
Behavioral task
behavioral1
Sample
ransomware.exe
Resource
win7
Behavioral task
behavioral2
Sample
ransomware.exe
Resource
win10v200722
Malware Config
Extracted
C:\Documents and Settings\read_me.txt
deathransom
Extracted
C:\Boot\bg-BG\read_me.txt
deathransom
Targets
-
-
Target
ransomware
-
Size
5.7MB
-
MD5
e3204b2e61223989b1562f5dee40eee0
-
SHA1
7bd50a3b0e3f9b4a543f750869ca3ee29b4798e1
-
SHA256
1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64
-
SHA512
19df0eb4c803e6eeb41abb1fb425f4d9cd6e4262aaeb8bbf7eb959a30f3db2533fd6aed13e055a9781371e9de37de4212d80a32862798368e5dd798763012bc4
Score10/10-
DeathRansom
Ransomware family first seen at the start of 2020. Initial versions did not actually encrypt files.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops desktop.ini file(s)
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-