A new ransomware named DeathRansom began to function as intended around mid-November, encrypting victim files and additionally, there was was a spike in the number of DeathRansom submissions. When executed, it added an extension to files, but they weren’t actually encrypted. Like many other ransomware variants, DeathRansom will attempt to clear shadow volume copies. DeathRansom doesn’t add an extension to the encrypted files but does append a file marker, ABEFCDAB, to the end of the encrypted files. There is a list of files not to encrypt, all other files are encrypted and a copy of the ransom note left in each directory where files have been encrypted. The ransom note asks for a fee of 0.1 BTC, payable to a specified wallet, within 12 hours of the files being encrypted. An email address is also provided. The report does not provide any indication of how DeathRansom has been distributed but does note that since the spike in submissions, reports have decreased significantly.