demonware | caae4a687cd5d377a4d9429c1a66323a3e06cf556abffb2e4f663e1ea54c4c54 | Triage

Sharing

General

Target

e038ed6403349984198eaf576099eaa0_JaffaCakes118
Size

9.7MB
Sample

240914-p3112avbjj
MD5

e038ed6403349984198eaf576099eaa0
SHA1

e5325adc058604bb09aa29904b79918a1f0fee37
SHA256

caae4a687cd5d377a4d9429c1a66323a3e06cf556abffb2e4f663e1ea54c4c54
SHA512

f0f94d65f2cb06778aed46245ba5143ad40fe123916a2146d883fa8f3dfb194a5f37da752b9b5f18f251791fe202ea7bb2061e143f2e4bf8b585c5be4f381e57
SSDEEP

196608:LHZ4TlJPa6z4J5qgD4ImjXEMGBO7oIrkBwcrFSp82giE2tBx1tmu:LHZQluWTKOzrkB3if

Score

10^/10

demonware discovery pyinstaller ransomware

Malware Config

Targets

- Target
  
  e038ed6403349984198eaf576099eaa0_JaffaCakes118
- Size
  
  9.7MB
- MD5
  
  e038ed6403349984198eaf576099eaa0
- SHA1
  
  e5325adc058604bb09aa29904b79918a1f0fee37
- SHA256
  
  caae4a687cd5d377a4d9429c1a66323a3e06cf556abffb2e4f663e1ea54c4c54
- SHA512
  
  f0f94d65f2cb06778aed46245ba5143ad40fe123916a2146d883fa8f3dfb194a5f37da752b9b5f18f251791fe202ea7bb2061e143f2e4bf8b585c5be4f381e57
- SSDEEP
  
  196608:LHZ4TlJPa6z4J5qgD4ImjXEMGBO7oIrkBwcrFSp82giE2tBx1tmu:LHZQluWTKOzrkB3if
Score

10^/10

demonware discovery ransomware
- DemonWare
  Ransomware first seen in mid-2020.
  ransomware demonware
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

demonwarediscoveryransomware

behavioral2