rhysida

General

Target
3d2013c2ba0aa1c0475cab186ddf3d9005133fe5f88b5d8604b46673b96a40d8.exe
Size 353KB
Sample250412-q2grfawjw8
SHA256 3d2013c2ba0aa1c0475cab186ddf3d9005133fe5f88b5d8604b46673b96a40d8
MD5 fac561bb0f072d29fe6f8ee6072c905a
SHA1 da29dc6bd9ba38d11d46665e42bed7d5c35f48fc
SHA512 0b5dcabd10c9cadbe6b98c3814a73a3d9f285578869821493d6cd7a87d1cdd1144de7a77dce1360b95c4ef0f96895a6f04c9dbbf15a3177866e9c2883b35727d
SSDEEP 6144:heigHPKpV1hH/lRLIRsdyhFNnofZwnADhY+xlgVv3M:UigHUz9lRvyLtiwnZ+xKU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  3d2013c2ba0aa1c0475cab186ddf3d9005133fe5f88b5d8604b46673b96a40d8.exe
- Size 353KB
- SHA256 3d2013c2ba0aa1c0475cab186ddf3d9005133fe5f88b5d8604b46673b96a40d8
- MD5 fac561bb0f072d29fe6f8ee6072c905a
- SHA1 da29dc6bd9ba38d11d46665e42bed7d5c35f48fc
- SHA512 0b5dcabd10c9cadbe6b98c3814a73a3d9f285578869821493d6cd7a87d1cdd1144de7a77dce1360b95c4ef0f96895a6f04c9dbbf15a3177866e9c2883b35727d
- SSDEEP 6144:heigHPKpV1hH/lRLIRsdyhFNnofZwnADhY+xlgVv3M:UigHUz9lRvyLtiwnZ+xKU
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

rhysida credential_access defense_evasion discovery execution persistence ransomware spyware stealer
- Detect Rhysida ransomware
- Rhysida
  Rhysida is a ransomware that is written in C++ and discovered in 2023.
  ransomware rhysida
- Rhysida family
  rhysida
- Clears Windows event logs
  defense_evasion ransomware
- Renames multiple (9423) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1