General
-
Target
200803-bktwtzlfze_pw_infected (1).zip
-
Size
5.4MB
-
Sample
200907-wf2al2qc7s
-
MD5
7566c76664218a2d02d2dc351a3f72c7
-
SHA1
4b628268a6da107077a4d3387e395a36b36060ed
-
SHA256
4a063ddfd524ae93da0369843416e7dee568283f2fbc5c68f611a50d6796895f
-
SHA512
2ee88061ed173eceea90d04ea5f011bca49f728b6b4f3306d46b3c534b4d3ccb3cb49b3c1c716ed97644af7453c74360cafdac09be48bd6047d8f6852da95d12
Static task
static1
Behavioral task
behavioral1
Sample
ransomware.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
ransomware.exe
Resource
win10
Malware Config
Extracted
C:\Documents and Settings\read_me.txt
deathransom
Extracted
C:\Boot\bg-BG\read_me.txt
deathransom
Targets
-
-
Target
ransomware
-
Size
5.7MB
-
MD5
e3204b2e61223989b1562f5dee40eee0
-
SHA1
7bd50a3b0e3f9b4a543f750869ca3ee29b4798e1
-
SHA256
1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64
-
SHA512
19df0eb4c803e6eeb41abb1fb425f4d9cd6e4262aaeb8bbf7eb959a30f3db2533fd6aed13e055a9781371e9de37de4212d80a32862798368e5dd798763012bc4
Score10/10-
DeathRansom
Ransomware family first seen at the start of 2020. Initial versions did not actually encrypt files.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops desktop.ini file(s)
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-