rhysida

General

Target

a0d4d52885b654cbfeefd194359936072133519c2bc7e8f68b7b668e59c67b94.exe
Size

497KB
Sample

241003-caabdsyclm
MD5

c43f12b8330643c72d21bad3b6cfcf82
SHA1

f453f42de8151323472dbe35b5d48084e0012216
SHA256

a0d4d52885b654cbfeefd194359936072133519c2bc7e8f68b7b668e59c67b94
SHA512

987ce1e4dd8f69100b1514a1c9b0a2abad5fa028dc9a22532fb088308596e8f372d30cb89f140927c459421febe762cfe3668ec21b9deb546e7a50266d605efe
SSDEEP

6144:UFoCbN9uRh5W8iZuYtWrJhN7L6aMFNCk0Y+sPgtuMf9opaMPdZXT:qvZTs7N78CrZsPgUG9oDlZ

Score

10^/10

Malware Config

Targets

- Target
  
  a0d4d52885b654cbfeefd194359936072133519c2bc7e8f68b7b668e59c67b94.exe
- Size
  
  497KB
- MD5
  
  c43f12b8330643c72d21bad3b6cfcf82
- SHA1
  
  f453f42de8151323472dbe35b5d48084e0012216
- SHA256
  
  a0d4d52885b654cbfeefd194359936072133519c2bc7e8f68b7b668e59c67b94
- SHA512
  
  987ce1e4dd8f69100b1514a1c9b0a2abad5fa028dc9a22532fb088308596e8f372d30cb89f140927c459421febe762cfe3668ec21b9deb546e7a50266d605efe
- SSDEEP
  
  6144:UFoCbN9uRh5W8iZuYtWrJhN7L6aMFNCk0Y+sPgtuMf9opaMPdZXT:qvZTs7N78CrZsPgUG9oDlZ
Score

10^/10

rhysida credential_access defense_evasion discovery evasion execution impact persistence ransomware spyware stealer
- Detect Rhysida ransomware
- Rhysida
  Rhysida is a ransomware that is written in C++ and discovered in 2023.
  ransomware rhysida
- Clears Windows event logs
  evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (8145) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2