DEATHRANSOM

**Executive Summary on DeathRansom Malware** DeathRansom is a malicious software strain that emerged in October 2020, characterized by its ability to encrypt files and demand ransom payments from victims. It has been linked to various ransomware families, including HelloKitty and Fivehands, which have targeted significant entities such as the Polish video game developer CD Projekt Red and VMware ESXi servers. The malware exploits vulnerabilities through suspicious downloads or email attachments, infiltrating systems without user consent and holding critical data hostage. The technical analysis reveals that DeathRansom is primarily written in C, distinguishing it from HelloKitty and Fivehands, which utilize C++. All three ransomware variants share several features, such as symmetric encryption methods (AES) and directory exclusion lists to avoid encrypting system-critical files. However, DeathRansom uniquely conducts external HTTPS connections for additional payloads, while Fivehands employs a memory-only dropper mechanism that requires specific command-line arguments for decryption, showcasing an evolution in ransomware deployment strategies. Since its identification, DeathRansom has demonstrated a high level of sophistication and adaptability, with versions that alter file extensions and include unique functionalities like mutex checks and locale validation. Mandiant's observations indicate a persistent threat from this malware family, emphasizing the need for robust cybersecurity measures to mitigate risks associated with ransomware attacks targeting both individual users and large organizations.