demonware | d9c92be725b8b72f58dc7abe26fd5a97bc65ebf06eeb3428153982fe96f2fec8 | Triage

Resubmissions

28/03/2025, 15:04

250328-sfzfgazjy8 10

27/03/2025, 11:41

250327-ntssmatkw5 10

Sharing

General

Target

d9c92be725b8b72f58dc7abe26fd5a97bc65ebf06eeb3428153982fe96f2fec8.zip
Size

11.7MB
Sample

250327-ntssmatkw5
MD5

e39fa1c76aa5fad87829a0c0d4707ff8
SHA1

3a5990fe8155e6b33f569fd8a3a90e82d1e8cd78
SHA256

d9c92be725b8b72f58dc7abe26fd5a97bc65ebf06eeb3428153982fe96f2fec8
SHA512

e4295e7eff1c1eb96ca30c81b76e7563cd1899bbfd0be81804d4d2a4dad037548e81290fc48778883a83521d4adf873c93055557a08a31e133eece7187968b9f
SSDEEP

196608:gBpAZ5joJoieY6w0/K46ms+yKU/AYHkiWzh/3Mvyxvt745zTVITox8eZGbW1miQE:+pAgJoicwdms+yKUhEKmvtk5zTGTe8e/

Score

10^/10

demonware discovery pyinstaller ransomware

Malware Config

Targets

- Target
  
  9353cf6347377bf1194349bff4001485fac99a5cd3ee03781e81c157452dae68.exe
- Size
  
  11.9MB
- MD5
  
  96a57994dac844201da03003ee2183ae
- SHA1
  
  e7cd1448b9b33c928b25451a9f72de71b2dbc7bf
- SHA256
  
  9353cf6347377bf1194349bff4001485fac99a5cd3ee03781e81c157452dae68
- SHA512
  
  5f82aa92a1f15287884bc7fcb26f7b0bcf2db0444417c678e613c46f0c9da0833845ca1fefc10ea35ec58ad6d7c9c627081bdf94915e41f136b6abdf3e6cf6de
- SSDEEP
  
  196608:wnHdJmVsyb49UuImXz1neX38DXDQ9/tbYPvbJQlHPrO2SvMTvN8CTJ+iGydotQa1:wnHdJmVsU4izm10MDTQ9/kJQlvrJTLxG
Score

10^/10

demonware discovery ransomware
- DemonWare
  Ransomware first seen in mid-2020.
  ransomware demonware
- Demonware family
  demonware
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

demonwarediscoveryransomware

behavioral2

demonwarediscoveryransomware