rhysida

General

Target

0050a69d6e93eddcd1ea4b7e951945f8970e5700d9436238bde7f63d757988ae.exe
Size

419KB
Sample

250412-q24afawjz4
MD5

26f41a46d0addde100bb9512a130de5e
SHA1

bef7719a8a98131b8bdf885895b5d1c3f9d089ad
SHA256

0050a69d6e93eddcd1ea4b7e951945f8970e5700d9436238bde7f63d757988ae
SHA512

99d09fe0f657d3c965429094ca1d077c4e1a5f066b0ae022dd6f344af6d8ebc9a5a559be2ab11019216e516688f5fa5daac15bae8d5d524bd665c56cfa07bd41
SSDEEP

6144:1OQ7bSLB+QbqZ0/xDPK8JLM7hsqMFUtkko1mJ8+ANqT:OmQx71M75tzOmJ8+

Score

10^/10

Malware Config

Targets

- Target
  
  0050a69d6e93eddcd1ea4b7e951945f8970e5700d9436238bde7f63d757988ae.exe
- Size
  
  419KB
- MD5
  
  26f41a46d0addde100bb9512a130de5e
- SHA1
  
  bef7719a8a98131b8bdf885895b5d1c3f9d089ad
- SHA256
  
  0050a69d6e93eddcd1ea4b7e951945f8970e5700d9436238bde7f63d757988ae
- SHA512
  
  99d09fe0f657d3c965429094ca1d077c4e1a5f066b0ae022dd6f344af6d8ebc9a5a559be2ab11019216e516688f5fa5daac15bae8d5d524bd665c56cfa07bd41
- SSDEEP
  
  6144:1OQ7bSLB+QbqZ0/xDPK8JLM7hsqMFUtkko1mJ8+ANqT:OmQx71M75tzOmJ8+
Score

10^/10

rhysida credential_access defense_evasion discovery execution ransomware spyware stealer
- Detect Rhysida ransomware
- Rhysida
  Rhysida is a ransomware that is written in C++ and discovered in 2023.
  ransomware rhysida
- Rhysida family
  rhysida
- Renames multiple (2503) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Sets desktop wallpaper using registry
  ransomware
behavioral1