{"id":17332,"date":"2020-01-02T19:40:19","date_gmt":"2020-01-03T03:40:19","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2020\/01\/02\/news-11068\/"},"modified":"2020-01-02T19:40:19","modified_gmt":"2020-01-03T03:40:19","slug":"news-11068","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2020\/01\/02\/news-11068\/","title":{"rendered":"The Curious Case of DeathRansom: Part I"},"content":{"rendered":"
\n
\n

A FortiGuard Labs Threat Analysis Report<\/b><\/i><\/p>\n

Introduction<\/h2>\n

Ransomware is certainly a significant global threat. According to one recent report<\/a>, ransomware is estimated to have cost businesses more than $8 billion in 2018, up from just $1 billion in 2016, while this year alone losses for the healthcare industry have already reached $25 billion.<\/p>\n

Part of this increase is due to the rise of Ransomware as a Service, with variants such as GandCrab generating as much as $2 billion in revenue for its developers, and our observation in the FortiGuard Labs Threat Landscape Report for Q3<\/a> that two additional ransomware families \u2013 Sodinokibi and Nemty \u2013 have now been deployed as RaaS solutions as well. Another part of the reason for this growth is that cybercriminals continue to develop new ransomware variants. This dramatic escalation of ransomware over the past few years is part of the reason why we here at FortiGuard Labs keep such close track<\/a> of it.<\/p>\n

And recently, our threat radar detected a new ransomware variant that we break down for you in this threat analysis, ominously called DeathRansom. In this analysis, we will first be looking at a version with a SHA256 sample of:<\/p>\n

7C2DBAD516D18D2C1C21ECC5792BC232F7B34DADC1BC19E967190D79174131D1<\/p>\n

Subsequent samples exhibit slightly different behaviors, as we describe later in our analysis.<\/p>\n<\/p><\/div>\n