Severity
High
Analysis Summary
A new ransomware named DeathRansom began to function as intended around mid-November, encrypting victim files and additionally, there was was a spike in the number of DeathRansom submissions. When executed, it added an extension to files, but they weren’t actually encrypted. Like many other ransomware variants, DeathRansom will attempt to clear shadow volume copies. DeathRansom doesn’t add an extension to the encrypted files but does append a file marker, ABEFCDAB, to the end of the encrypted files. There is a list of files not to encrypt, all other files are encrypted and a copy of the ransom note left in each directory where files have been encrypted. The ransom note asks for a fee of 0.1 BTC, payable to a specified wallet, within 12 hours of the files being encrypted. An email address is also provided. The report does not provide any indication of how DeathRansom has been distributed but does note that since the spike in submissions, reports have decreased significantly.
Impact
File encryption
Indicators of Compromise
Email
deathransom@airmail.cc
SHA-256
- 87d745aa921f201bccb4dd6a6f5af9f0d9c9312114f46779c8980b6f8193f099
- da47aa3b75c85091c708366a8d8534789887b6cc42f42794b0652e280d56a405
- 7c2dbad516d18d2c1c21ecc5792bc232f7b34dadc1bc19e967190d79174131d1
- fedb4c3b0e080fb86796189ccc77f99b04adb105d322bddd3abfca2d5c5d43c8
- 0cf124b2afc3010b72abdc2ad8d4114ff1423cce74776634db4ef6aaa08af915
- ab828f0e0555f88e3005387cb523f221a1933bbd7db4f05902a1e5cc289e7ba4
- 5ac169ed286f20cbb4a18a078f0a090b5771a5155120ffca8bd7f875b38ae8a6
- 13d263fb19d866bb929f45677a9dcbb683df5e1fa2e1b856fde905629366c5e1
- 2b9c53b965c3621f1fa20e0ee9854115747047d136529b41872a10a511603df8
- 66ee3840a9722d3912b73e477d1a11fd0e5468769ba17e5e71873fd519e76def
Remediation
- Block all threat indicators at your respective controls.
- Always be suspicious about emails sent by unknown senders.
- Never click on the links/attachments sent by unknown senders.