DEATHRANSOM

Executive Summary

DEATHRANSOM is a C‑based Windows ransomware first detected in 2020 that encrypts victim files, deletes originals, and displays a ransom notice. It shares code with FiveHands and HelloKitty, indicating possible reuse of tooling for credential harvesting and lateral movement. The malware targets systems without adequate backups or segmentation, posing a high risk to enterprise environments.

DEATHRANSOM is a Windows‑only ransomware family that has been observed in the wild since at least 2020. The codebase was crafted in C and exhibits several design elements that suggest a shared lineage or tooling with the well‑known FiveHands and HelloKitty campaigns, as noted by FireEye in their April 2021 investigation into FiveHands. In typical ransomware fashion, DEATHRANSOM encrypts victim files using strong symmetric ciphers (AES‑256) before deleting original plaintext copies. It then generates a unique key pair per infection, uploads the data to an attacker controlled command and control server, and delivers a ransom note that instructs victims to pay 0.2 BTC for the decryption key. During installation, the malware creates persistence mechanisms on registry autostart keys (HKLM\Software\Microsoft\Windows\CurrentVersion\Run) and checks for system backups or removable media to encrypt further. The threat intelligence community notes that DEATHRANSOM shares several capabilities with FiveHands: it attempts lateral movement by harvesting credentials via brute‑force RDP attacks, probes network shares for additional data, and sometimes exfiltrates small information blobs before delivering the ransom. While a full payload set is not publicly documented, the overlap in code signatures and infection vectors suggests that security teams should monitor for behaviors typical of recent ransomware families, including the use of portable executable delivery via malicious email attachments or compromised web sites. Overall, DEATHRANSOM represents a persistent threat to Windows users and enterprise environments that have insufficient backup, patching, or network segmentation. Its attack surface is broadened by possible cross‑campaign tooling, which could allow attackers to reuse components across multiple ransomware operations, increasing both the sophistication and the potential damage caused by each infection batch.

Key Capabilities

• Encrypts user files using AES‑256
• Deletes original plaintext copies
• Creates persistence via registry autostart keys
• Attempts lateral movement by brute forcing RDP credentials
• Scans network shares for additional data
• Exfiltrates brief blobs before ransom delivery

ATT&CK Techniques

Recommended Actions

• Implement multi‑factor authentication and lock down unused RDP access
• Segment critical servers from the rest of the network and monitor for lateral movement attempts
• Conduct regular, offline backups of critical data and validate restore processes
• Enable Windows Defender Exploit Guard or equivalent to block suspicious registry writes
• Apply timely security updates and patch known vulnerabilities
• Use intrusion detection systems tuned to detect ransomware encryption behavior (e.g., high file write rates, new encrypted files with specific extensions)

Suggested Tags