General
- Target 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk
- Size 11.5MB
- Sample250317-bw8weawsbz
- SHA256 bf0e8e9c10d34111aa67a2ef8582518144362096c4942cec0cdc9c8c3dbfdcb9
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Desktop\README.txt
-
demonware
Ransom Note
- Tango Down! Seems like you got hit by DemonWare ransomware! Don't Panic, you get have your files back! DemonWare uses a basic encryption script to lock your files. This type of ransomware is known as CRYPTO. You'll need a decryption key in order to unlock your files. Your files will be deleted when the timer runs out, so you better hurry. You have 10 hours to find your key C'mon, be glad I don't ask for payment like other ransomware. Please visit: https://keys.zeznzo.nl and search for your IP/hostname to get your key. Kind regards, Zeznzo
URLs
-
https://keys.zeznzo.nl
Targets
-
- Target 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk
- Size 11.5MB
- SHA256 bf0e8e9c10d34111aa67a2ef8582518144362096c4942cec0cdc9c8c3dbfdcb9
Score10/10-
DemonWare
Ransomware first seen in mid-2020.
-
Demonware family
-
Loads dropped DLL