rhysida

General

Target
f6f74e05e24dd2e4e60e5fb50f73fc720ee826a43f2f0056e5b88724fa06fbab.exe
Size 422KB
Sample250412-qwbcgavrt4
SHA256 f6f74e05e24dd2e4e60e5fb50f73fc720ee826a43f2f0056e5b88724fa06fbab
MD5 fbbb2685cb612b25c50c59c1ffa6e654
SHA1 134c25e1b864f14d25e06d29cce0ca0b90968b44
SHA512 742bc03195939abeedca1f8ab5fe6c2d9b25227c10ee286b8d7b5393b956b68f1683b63ea21b3b1756a3208f9826b525511d216f421118d48bb0c59442ee55b0
SSDEEP 6144:pzOu5u9brOPsosL5wJ8gElIJ/P7xJrMFKtkB3YDHit1w9T:3DUlhsP7/tyIbit2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  f6f74e05e24dd2e4e60e5fb50f73fc720ee826a43f2f0056e5b88724fa06fbab.exe
- Size 422KB
- SHA256 f6f74e05e24dd2e4e60e5fb50f73fc720ee826a43f2f0056e5b88724fa06fbab
- MD5 fbbb2685cb612b25c50c59c1ffa6e654
- SHA1 134c25e1b864f14d25e06d29cce0ca0b90968b44
- SHA512 742bc03195939abeedca1f8ab5fe6c2d9b25227c10ee286b8d7b5393b956b68f1683b63ea21b3b1756a3208f9826b525511d216f421118d48bb0c59442ee55b0
- SSDEEP 6144:pzOu5u9brOPsosL5wJ8gElIJ/P7xJrMFKtkB3YDHit1w9T:3DUlhsP7/tyIbit2
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

rhysida credential_access defense_evasion discovery execution impact persistence ransomware spyware stealer
- Detect Rhysida ransomware
- Rhysida
  Rhysida is a ransomware that is written in C++ and discovered in 2023.
  ransomware rhysida
- Rhysida family
  rhysida
- Clears Windows event logs
  defense_evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (9679) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1