Loading malware…
DeathRansom is a Windows ransomware family first observed in late 2019. Early variants behaved inconsistently and in some cases only renamed files, while later variants implemented real encryption and extortion. The malware is associated with the name Wacatac in some detections and internal artifacts, and it has been discussed as part of a lineage that precedes or relates to later families such as HelloKitty and FiveHands. Activity has been reported in South Korea and against broader global targets, with indications that operators favored English-speaking victims while retaining the ability to spread more widely.
DeathRansom targets local drives, logical drives, directories, mounted drives, and network resources. It can enumerate network shares and remote resources through Windows networking APIs and loop-based traversal logic, enabling broader impact across accessible storage. Some variants also use WMI to delete Volume Shadow Copies, reducing recovery options for victims. The malware excludes selected system directories and files from processing to preserve system operability during encryption.
The family evolved from early pseudo-encryption behavior into later versions that used a more complex cryptographic workflow. Reported implementations include Curve25519-based ECDH, Salsa20, RSA-2048, AES-256, SHA-256, and XOR-based processing. Later variants generated victim-specific key material, stored cryptographic data in the current user registry hive under Wacatac-themed locations, and appended encrypted key material plus a marker to processed files. Ransom notes instructed victims to contact the operators and pay in Bitcoin, and some versions included a victim-specific lock identifier.
DeathRansom performs locale and keyboard-layout checks and exits on systems configured for several CIS-region languages, including Russian, Belarusian, Kazakh, Ukrainian, and Tatar. This geofencing behavior is consistent with many Russian-speaking cybercriminal operations. Reporting has also linked DeathRansom campaigns to infrastructure and tradecraft overlaps with Vidar, Azorult, Evrial stealer, 1ms0rryStealer, and Supreme miner, with attribution pointing to a likely Russian-speaking actor using the online personas scat01 and SoftEgorka. Those links are based on shared infrastructure, naming conventions, and campaign artifacts rather than public judicial attribution.
Delivery has been described broadly as including insecure RDP exposure, spam or malicious attachments, deceptive downloads, botnets, exploits, malvertising, fake updates, and trojanized installers, but these mechanisms are not all tied to directly observed initial access for every campaign. DeathRansom is notable historically for its rapid evolution from a crude early build into a more capable ransomware family and for its apparent relationship to subsequent ransomware development.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
FortiGuard Labs recently discovered an ongoing DeathRansom malicious campaign... as you may remember from our first blog, DeathRansom uses the name ‘Wacatac’ to store crypto keys in a registry.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
The content repeatedly describes threat actors and malware using WMI/WMIC/wmiexec for remote execution, lateral movement, discovery, persistence, and administrative actions; e.g., 'APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit' and 'Scattered Spider used Windows Management Instrumentation (WMI) to move laterally via Impacket.'
the malware comes in a packed formal and many noisy mangled symbols generated by the C++ Compiler, so let’s try to unpack it using some methods and techniques
we see another call to GetProcAddress() which is used to get the address of an API
DEATHRanom 랜섬웨어는 아래 폴더와 파일을 제외하고 모두 감염 대상이다. 감염 제외 목록 폴더 Programdata, $recycle bin, program files, windows, all users, appdata 파일 read_me.txt, autoexec.bat, desktop.ini, autorun.inf, ntuser.dat, iconcache.db, bootsect.back, boot.ini, ntuser.dat, thumbs.db
The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."
Examples include: "Babuk can enumerate disk volumes," "Confucius has used a file stealer that can examine system drives," and "XAgentOSX contains the getInstalledAPP function to run ls -la /Applications to gather what applications are installed."
Numerous entries mention enumerating drives, logical disks, disk type, free space, or volume information; examples include 'Babuk can enumerate disk volumes,' 'Cuba can enumerate local drives,' and 'TAINTEDSCRIBE can use DriveList to retrieve drive information.'
APT1 listed connected network shares. APT32 used the net view command to show all shares available, including the administrative shares such as C$ and ADMIN$. APT41 used the net share command as part of network reconnaissance.
At a high level, this ransomware follows a sensible design: it scans and encrypts files on local and network drives.
34 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware that deletes volume shadow copies on compromised hosts.
Ransomware with at least two described variants: one variant merely appends the ".wctc" extension without actually encrypting file contents, while another encrypts files without appending an extension. The sample discussed is packed and uses staged shellcode unpacking via APIs such as LocalAlloc, VirtualAlloc, VirtualProtect, and GetProcAddress before revealing the final PE payload.
Ransomware capable of enumerating network resources via loop operations.
Enterprise New Software: ... DEATHRANSOM
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.