{
  "family": "demp",
  "sample_count": 18,
  "category": "ransomware",
  "description": "Demp (classified in antivirus signatures as Ransom:Win32/Demp, Trojan-Ransom.Win32.Demp, and Ransom.Demp) is a destructive Windows crypto-ransomware family engineered for high-speed file encryption across enterprise workstations and servers. Propagated through spear-phishing payloads and brute-forced remote desktop accounts, Demp scans logical drives for high-value extensions (documents, databases, source code, and virtual machine images). It invokes administrative commands to delete volume shadow copies ('vssadmin delete shadows /all /quiet'), clear Windows event logs using wevtutil ('wevtutil cl Application', 'wevtutil cl System'), and stop running database engines (MSSQL, MySQL). Demp encrypts target files using AES-256 in CBC mode, appending the '.demp' extension to filenames, and places ransom notes ('_readme.txt' or 'DEMP_INFO.txt') directing victims to an extortion payment site.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Demp",
    "Trojan-Ransom.Win32.Demp",
    "Win32/Demp",
    "Ransom.Demp",
    "Demp Ransomware"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Demp?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Demp is a destructive Windows crypto-ransomware family that encrypts files and clears event logs using AES-256 cryptography."
      }
    },
    {
      "@type": "Question",
      "name": "How does Demp evade forensic investigation?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes wevtutil commands to clear Windows event logs and deletes volume shadow copies to hinder analysis."
      }
    },
    {
      "@type": "Question",
      "name": "How does Demp spread to victim systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It spreads via spear-phishing email attachments, malicious software updates, and brute-forced RDP accounts."
      }
    },
    {
      "@type": "Question",
      "name": "Can files with the .demp extension be decrypted without the private key?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Decryption without the attacker's private key is mathematically infeasible due to the use of AES-256 with RSA protection."
      }
    },
    {
      "@type": "Question",
      "name": "What defensive measures protect against Demp infections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Enforce multi-factor authentication on RDP, maintain immutable offline backups, and deploy EDR to block shadow copy deletion."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1070.001",
    "T1083",
    "T1489"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2019,
  "threat_actor": null,
  "delivery_mechanism": [
    "Spear-phishing Emails with Malicious Attachments",
    "Compromised Remote Desktop Protocol (RDP)",
    "Trojanized Software Installers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server"
  ],
  "capabilities": [
    "High-Speed Hybrid File Encryption (AES-256 + RSA)",
    "Automated Shadow Copy & Event Log Clearing",
    "Database & Security Service Termination",
    "Local Drive & Network Folder Traversal",
    "Automated Ransom Note Generation"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable"
    ],
    "network_signatures": [
      "Outbound HTTP/HTTPS traffic reporting infection metrics to remote C2",
      "Internal SMB port scanning traffic detecting network file shares"
    ],
    "evasion_techniques": [
      "Clearing Windows Application and System security event logs via wevtutil",
      "Code obfuscation and encrypted string tables to defeat static signatures"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d",
      "7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\DempLocker"
    ],
    "file_paths": [
      "%AppData%\\Demp\\demp.exe",
      "C:\\_readme.txt"
    ]
  },
  "defensive_measures": [
    "Forward Windows event logs to an immutable centralized SIEM to preserve forensic records before local log clearing",
    "Maintain immutable, air-gapped backups to ensure full recovery without paying ransoms",
    "Deploy endpoint detection and response (EDR) rules alerting on execution of wevtutil cl"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Demp",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Demp"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom.Win32.Demp",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Ransom:Win32/Demp.A",
      "Ransom:Win32/Demp.B"
    ]
  },
  "attack_stage": [
    "initial_access",
    "execution",
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Extortion & Data Encryption",
  "sample_hashes": []
}