demonware

General

Target

OmeksBlank.doc
Size

37KB
Sample

210322-73rx4x3g56
MD5

51f6b8678de15611bf15e7544dc87c87
SHA1

4d04e4490d3bb3590d94bb2dc8038011fadfbec4
SHA256

2966d4d96bf053a15a2665464327f3fd5165bd03587679452b1db4f3f03946e9
SHA512

fdef0c2194c02d39372f6c3e80ddfb27fa35700cda378af60073c017da30df5b8d8dadb022851edf777c69b84fd4e9a754c1fd823fae5408a3e795f2d2b930b0

Score

10^/10

Malware Config

Extracted

Path

\??\c:\README.txt

Ransom Note

Your files have been uploaded to our server and encrypted! They cannot be decrypted without our key, which was generated individually for your computer. The only thing you can do now is to buy a key and a decoder within 10 hours! If you do not, after 10 hours your private key will be deleted from our server, you will lose your encrypted files forever, and we will publish your files on the internet. Send 0.006 Bitcoin to the BTC address: bc1qhffuqkuwmenevjq6erfkfr043qv2dlgujq4h0g Then send the transaction ID and your ID to the following email address: [email protected] or [email protected] We respond to emails only after receiving the payment. After payment, we will send our decoder and decryption code to your computer within a few hours. You just need to run it and it will ensure that all the files are automatically decrypted (unless you have renamed or changed them)! Don't worry, if the conditions are met, all your data will be restored and deleted from our server. We have no reason to cheat you after payment. < < Where can I buy and send Bitcoins?> > The easiest way to buy Bitcoins is through the LocalBitcoins website. You need to register, click the "buy bitcoin" button and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins or https://bitcoin.org/en/buy https://buy.moonpay.io Here you will also find other places to buy bitcoins and a beginner leader: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ ATTENTION! Antivirus software, third-party services, or any other person cannot decrypt your files, and attempts to change, rename, or move your files may damage them, and even we cannot recover them. YOUR ID:'as693t'0fd4b'991f399af8b7d5b3c7b9aeef2e367499'

Emails

[email protected]

Wallets

bc1qhffuqkuwmenevjq6erfkfr043qv2dlgujq4h0g

URLs

https://bitcoin.org/en/buy

https://buy.moonpay.io

Targets

- Target
  
  OmeksBlank.doc
- Size
  
  37KB
- MD5
  
  51f6b8678de15611bf15e7544dc87c87
- SHA1
  
  4d04e4490d3bb3590d94bb2dc8038011fadfbec4
- SHA256
  
  2966d4d96bf053a15a2665464327f3fd5165bd03587679452b1db4f3f03946e9
- SHA512
  
  fdef0c2194c02d39372f6c3e80ddfb27fa35700cda378af60073c017da30df5b8d8dadb022851edf777c69b84fd4e9a754c1fd823fae5408a3e795f2d2b930b0
Score

10^/10

pyinstaller demonware ransomware spyware stealer
- DemonWare
  Ransomware first seen in mid-2020.
  ransomware demonware
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops file in System32 directory
behavioral1 behavioral2