Malware
DEVMAN
DEVMAN is a ransomware which shares a large part of its codebase with DragonForce ransomware.
DEVMAN is a Windows malware family operated by DragonForce and [Unnamed group].
Background
DEVMAN is a ransomware that overlaps heavily with the DragonForce ransomware codebase. The operators most likely took a DragonForce build and merely swapped the extension appended to encrypted files (from .dragonforce_encrypted to .devman). One of the earliest samples even carried a ransom note still identifying itself with the DragonForce Ransomware Cartel.
It includes typical capabilities such as deleting ShadowCopies and skipping encryption for files whose extensions appear in a hard-coded list. The ransomware offers several encryption modes:
- Full encryption
- Header-only encryption
- Custom encryption
These let the operator trade speed for cryptographic strength depending on the situation. It additionally attempts to reach SMB shares.
DEVMAN sets up a temporary session under the registry key HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000, employing the Restart Manager to defeat file locks and gain access to files held open in an active user session. This trait appears inherited from Conti ransomware, the lineage behind both DragonForce and DEVMAN, and as part of that lineage the ransomware relies on a hard-coded mutex to stop concurrent instances from executing.
Source: Malpedia (Fraunhofer FKIE).