General
- Target 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk
- Size 11.8MB
- Sample250318-b64pfastdv
- SHA256 e19d00767aa93ad6e6de89901fe2a2ad389dd3824036ac9a796fdd50723e0707
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Pictures\README.txt
-
demonware
Ransom Note
- Tango Down! Seems like you got hit by DemonWare ransomware! Don't Panic, you get have your files back! DemonWare uses a basic encryption script to lock your files. This type of ransomware is known as CRYPTO. You'll need a decryption key in order to unlock your files. Your files will be deleted when the timer runs out, so you better hurry. You have 10 hours to find your key C'mon, be glad I don't ask for payment like other ransomware. Please visit: https://keys.zeznzo.nl and search for your IP/hostname to get your key. Kind regards, Zeznzo
URLs
-
https://keys.zeznzo.nl
Targets
-
- Target 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk
- Size 11.8MB
- SHA256 e19d00767aa93ad6e6de89901fe2a2ad389dd3824036ac9a796fdd50723e0707
Score10/10-
DemonWare
Ransomware first seen in mid-2020.
-
Demonware family
-
Loads dropped DLL