New Version of DeathRansom Ransomware Aggressively Encrypts Network Drive Files After it’s Encryption Bug Fixed by Author

DeathRansom – A new ransomware strain that evolves from no encryption to using a combination of encryption algorithms to encrypt files.

The ransomware strain observed first in earlier November, it pretends to encrypt files, but it only appends the extension, users able to recover the files by just removing the extension.

Researchers from Fortinet observed that the threat is evolving and uses a combination of algorithms to encrypt files.

DeathRansom Ransomware

Like other ransomware, it enumerates and encrypts files on local and network drives. It avoids encrypting important folders such as (Program Files, Windows, etc) and system files.

Before encryption, the ransomware performs language checks if the system is from Eastern European countries then it avoids encrypting.

The New version capable of encryption includes “a combination of Curve25519 algorithm for the Elliptic Curve Diffie-Hellman (ECDH) key exchange scheme, Salsa20, RSA-2048, AES-256 ECB, and a simple block XOR algorithm to encrypt files,” reads Fortinet blog post.

Ransomware Encryption key Pairs

Once the encryption process completed it drops a ransom note and it includes a lock-ID unique to every user.

Ransomware Encryption Note

The samples observed by researchers found to be compiled on a machine that has the Slovak language installed by default. Most of the samples downloaded from the hacked .es, but one sample is from a different URL.

This gives a lead to researchers, the link contains a profile “scat01”, further analysis reveals it has a connection to Vidar stealer malware family.

Link of sample

So researchers decided to look for the malware associated with profile “scat01”, the number of malware samples found to be associated that includes;

  1. DeathRansom
  2. Vidar stealer
  3. Azorult stealer
  4. Evrial stealer
  5. 1ms0rryStealer
  6. Supreme miner

All the samples found to be purchased on Russian underground forums, so researchers started searching for “scat01” and “Vidar” on underground forums, several posts found associated with profile “scat01”. More details of attribution can be found here.

Actor Profile on Underground Forum

DeathRansom is a new ransomware strain, and the actor behind ransomware continues to implement new features. “Researchers believe the user with the nickname “scat01″ could be responsible for the latest DeathRansom attack.”

Also Find: Ransomware Attack Response and Mitigation Checklist

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

View Comments

Recent Posts

Indonesia Government Data Breach – Hackers Leaked 82 GB of Sensitive Data Online

Hackers have reportedly infiltrated and extracted a vast 82 GB of sensitive data from the Indonesian…

2 hours ago

IBM AIX TCP/IP Vulnerability Lets Attackers Exploit to Launch Denial of Service Attack

IBM has issued a security bulletin warning of two vulnerabilities in its AIX operating system…

3 hours ago

Apache Auth-Bypass Vulnerability Lets Attackers Gain Control Over HugeGraph-Server

The Apache Software Foundation has issued a security alert regarding a critical vulnerability in Apache…

3 hours ago

USA Launched Cyber Attack on Chinese Technology Firms

The Chinese National Internet Emergency Center (CNIE) has revealed two significant cases of cyber espionage…

4 hours ago

Node.js systeminformation Package Vulnerability Exposes Millions of Systems to RCE Attacks

A critical command injection vulnerability in the popular systeminformation npm package has recently been disclosed, exposing millions…

2 days ago

Skuld Malware Using Weaponized Windows Utilities Packages To Deliver Malware

Researchers discovered a malware campaign targeting the npm ecosystem, distributing the Skuld info stealer through…

2 days ago