rhysida

General

Target

Rhysida.7z
Size

165KB
Sample

250330-bv6pnazjv5
MD5

bced1d7881b3d1acdb363ccf98ab054a
SHA1

21e01470d0de1f2468dc24038cf2cea26f318adc
SHA256

84a17795e393b244326630d0665d6c38762facb8664b90615276316f259a513f
SHA512

ac2bc044a3800e0cd69ed6d745fe843e913338bec7ecb9d0f4183eed0e880f56dfa362e8be534b93575f47ef6f180528b7868bb735174b3fd6e011c35c34ef0d
SSDEEP

3072:6nVf3ZmJHyYUsPEaWw0UeBfu0ydHuefdhLiFqomWBzafniNj2KSNwP0xY5ZSi:6lARyoZWwtFdnCqomWByZNwcxYKi

Score

10^/10

Malware Config

Targets

- Target
  
  3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe
- Size
  
  421KB
- MD5
  
  2b825ea77e240d2ab6b6695a602cb07c
- SHA1
  
  ae6eb3cce06f666934e03dd46269526e56aff3b1
- SHA256
  
  3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f
- SHA512
  
  f2029aec439f4727e96436390027e100df521cd6557797a17d50f82335487b2a91ddc04dbd18fb8df96b3deea776ecf429321a55401b7739b1b4979b58db7e39
- SSDEEP
  
  6144:/u+2b7RNhPmrpQRF/2lfhOJoe7NzgMFgTkoQj6RgLaDMT:nGyRe7STng6KaD
Score

10^/10

rhysida credential_access defense_evasion discovery execution ransomware spyware stealer
- Detect Rhysida ransomware
- Rhysida
  Rhysida is a ransomware that is written in C++ and discovered in 2023.
  ransomware rhysida
- Rhysida family
  rhysida
- Renames multiple (659) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Sets desktop wallpaper using registry
  ransomware
behavioral1