New Version of DeathRansom Ransomware Aggressively Encrypts Network Drive Files After it’s Encryption Bug Fixed by Author

DeathRansom – A new ransomware strain that evolves from no encryption to using a combination of encryption algorithms to encrypt files.

The ransomware strain observed first in earlier November, it pretends to encrypt files, but it only appends the extension, users able to recover the files by just removing the extension.

Researchers from Fortinet observed that the threat is evolving and uses a combination of algorithms to encrypt files.

DeathRansom Ransomware

Like other ransomware, it enumerates and encrypts files on local and network drives. It avoids encrypting important folders such as (Program Files, Windows, etc) and system files.

Before encryption, the ransomware performs language checks if the system is from Eastern European countries then it avoids encrypting.

The New version capable of encryption includes “a combination of Curve25519 algorithm for the Elliptic Curve Diffie-Hellman (ECDH) key exchange scheme, Salsa20, RSA-2048, AES-256 ECB, and a simple block XOR algorithm to encrypt files,” reads Fortinet blog post.

Ransomware Encryption key Pairs

Once the encryption process completed it drops a ransom note and it includes a lock-ID unique to every user.

Ransomware Encryption Note

The samples observed by researchers found to be compiled on a machine that has the Slovak language installed by default. Most of the samples downloaded from the hacked .es, but one sample is from a different URL.

This gives a lead to researchers, the link contains a profile “scat01”, further analysis reveals it has a connection to Vidar stealer malware family.

Link of sample

So researchers decided to look for the malware associated with profile “scat01”, the number of malware samples found to be associated that includes;

  1. DeathRansom
  2. Vidar stealer
  3. Azorult stealer
  4. Evrial stealer
  5. 1ms0rryStealer
  6. Supreme miner

All the samples found to be purchased on Russian underground forums, so researchers started searching for “scat01” and “Vidar” on underground forums, several posts found associated with profile “scat01”. More details of attribution can be found here.

Actor Profile on Underground Forum

DeathRansom is a new ransomware strain, and the actor behind ransomware continues to implement new features. “Researchers believe the user with the nickname “scat01″ could be responsible for the latest DeathRansom attack.”

Also Find: Ransomware Attack Response and Mitigation Checklist

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

View Comments

Recent Posts

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS devices.…

1 day ago

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch Experts…

3 days ago

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan exploits…

3 days ago

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on organizations…

3 days ago

Google Chrome Security, Critical Vulnerabilities Patched

Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to millions…

4 days ago

Notorious WrnRAT Delivered Mimic As Gambling Games

WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling games…

4 days ago