devman

General

Target
crm.exe
Size 1.7MB
Sample260125-dwmz2sev7c
SHA256 a3b492379eb998eec7964c8f8fff43c5d17890354946b82224a2be81f96d6025
MD5 c63e0014d8d01eed850fae41212ccf38
SHA1 b6f8d51ee784fb8f4060e9882f90a2c707ee412f
SHA512 aaa9a055d5fd5a1c75b1b062e880482171b8ba2af7e6b81a7762a2db57c1e474e9df300a0240c5393ab54cda10ac4030a98129747f4d74cdf04439406a51c955
SSDEEP 24576:RrYottM3V52zhP+427kZVl1bXCS9KlRjW3Z9ZrUv7TVzc6IIA0JlupmSydRd/xib:REtpQ9avfVJYm7FUfyty
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\readme.txt

devman

Ransom Note

Good afternoon, As you can see you have been attacked by a ransomware program! We The DragonForce Ransomware Cartel offer you to make a deal with us. We can make a deal with you, all you need to do is contact us by following the instructions below. We are in no way connected to politics, we always keep our word. You have a chance to decrypt your files and avoid being published on our blog! Use this opportunity and also don't waste your time. The approximate date of deletion of the decryptor program, as well as publication on our blog 26/01/2026 00:00 UTC. - # 1 Communication Process, In order to contact us you need to click on the special link below, which is listed in #2. After that the negotiation process begins, in which you have the opportunity to request several things from us, 1. make a test decrypt. 2. get a list of the files stolen from you. At the conclusion of our negotiations we agree on a price, we set the price ourselves based on your income/your insurance. We scrutinize your documents and are well aware of how much income your company has per year. - # 2 Access to the meeting room, To access us please download Tor Browser which is available here. (https://www.torproject.org/) Once you download the special anonymous browser you need to follow this link, http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion Your unique ID: 73F899E2898F83A073F899E2898F83A0 - use it to enter our meeting room. - # 3 Additional Support Contacts, Tox: 1C054B722BCBF41A918EF3C485712742088F5C3E81B2FDD91ADEA6BA55F4A856D90A65E99D20 - # 4 Recommendations, Do not try to recover your files with third-party programs, you will only do harm. Do not turn off / reboot your computer. Be courteous in our meeting room. Do not procrastinate. - # 5 Blog and News, Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion DragonNews: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/news

URLs

http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/news

Targets

- Target
  crm.exe
- Size 1.7MB
- SHA256 a3b492379eb998eec7964c8f8fff43c5d17890354946b82224a2be81f96d6025
- MD5 c63e0014d8d01eed850fae41212ccf38
- SHA1 b6f8d51ee784fb8f4060e9882f90a2c707ee412f
- SHA512 aaa9a055d5fd5a1c75b1b062e880482171b8ba2af7e6b81a7762a2db57c1e474e9df300a0240c5393ab54cda10ac4030a98129747f4d74cdf04439406a51c955
- SSDEEP 24576:RrYottM3V52zhP+427kZVl1bXCS9KlRjW3Z9ZrUv7TVzc6IIA0JlupmSydRd/xib:REtpQ9avfVJYm7FUfyty
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

credential_access discovery devman ransomware spyware stealer
- Devman
  Devman is a ransomware forked from the DragonForce ransomware.
  ransomware devman
- Devman family
  devman
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2