Overview

overview

10

Static

static

3

2024-06-12...da.exe

windows7-x64

10

2024-06-12...da.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida

  • Size

    906KB

  • Sample

    240612-a2yf7awhrj

  • MD5

    7cfba113342f78b5909f606c26fc1dc4

  • SHA1

    f9e65f0cb46128bdc218053e1549c5e584ab6cd5

  • SHA256

    b183b142d3c4e99ee07c3407b82858146fa61ded95be2e67ce920c8002309fb0

  • SHA512

    9339d2b22b074f0357dd1319d02e6675394bb6c9fbd5d6ac51bc5554c95b5d0044bf05e0c3626c4f79f9c0a48dcb0a4063a32cdd99531ee8071491b661cc24d2

  • SSDEEP

    6144:BYdNbzC+2VEIxgYClW0ClmQzrAczJPBv7ameMF87XUPwfO+jOT:SkLClW0ClmQzrtFBv767XcoO+

Score
10/10
rhysidaransomwarespywarestealer

Malware Config

Targets

    • Target

      2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida

    • Size

      906KB

    • MD5

      7cfba113342f78b5909f606c26fc1dc4

    • SHA1

      f9e65f0cb46128bdc218053e1549c5e584ab6cd5

    • SHA256

      b183b142d3c4e99ee07c3407b82858146fa61ded95be2e67ce920c8002309fb0

    • SHA512

      9339d2b22b074f0357dd1319d02e6675394bb6c9fbd5d6ac51bc5554c95b5d0044bf05e0c3626c4f79f9c0a48dcb0a4063a32cdd99531ee8071491b661cc24d2

    • SSDEEP

      6144:BYdNbzC+2VEIxgYClW0ClmQzrAczJPBv7ameMF87XUPwfO+jOT:SkLClW0ClmQzrtFBv767XcoO+

    Score
    10/10
    rhysidaransomwarespywarestealer

    • Rhysida

      Rhysida is a ransomware that is written in C++ and discovered in 2023.

      ransomwarerhysida

    • Renames multiple (8059) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks