General
- Target Python Ransom BlackKingdom
- Size 9.8MB
- Sample200915-4fbtlez4fx
- SHA256 8dc94d486fd546ffbf8f21252aba65efe18432a6cae815e02b8be4ce4449291a
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Downloads\README.txt
-
demonware
Ransom Note
- Tango Down! Seems like you got hit by DemonWare ransomware! Don't Panic, you get have your files back! DemonWare uses a basic encryption script to lock your files. This type of ransomware is known as CRYPTO. You'll need a decryption key in order to unlock your files. Your files will be deleted when the timer runs out, so you better hurry. You have 10 hours to find your key C'mon, be glad I don't ask for payment like other ransomware. Please visit: https:xyz.io and search for your IP/hostname to get your key. Kind regards, arman
Targets
-
- Target Python Ransom BlackKingdom
- Size 9.8MB
- SHA256 8dc94d486fd546ffbf8f21252aba65efe18432a6cae815e02b8be4ce4449291a
Score10/10-
DemonWare
Ransomware first seen in mid-2020.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Loads dropped DLL
-
JavaScript code in executable