rhysida

General

Target

8061bb999a0f5d3165742283001a7a68e7905718c928172343bf8456b69f268d.exe
Size

497KB
Sample

250412-qx3hcavry9
MD5

bea5c2c91e1fa97854c65ece18456b0e
SHA1

2ed560ed6d90b42e79da906625a03e743f742369
SHA256

8061bb999a0f5d3165742283001a7a68e7905718c928172343bf8456b69f268d
SHA512

1f67af2e4960b469742bdf55e43d04c9b00a87f31e1272cc7c857275837b3aa7f665cb47ecfb88f99d1a35feddde5d0a96283936ff45cdddb60be3d8caea7a50
SSDEEP

6144:LgVoyb9e9BhzGcIo6gCJv47raqMFdiksMi9agtuMf9opaiYOmDdnT:com47ciTt9agUG9oCOmD

Score

10^/10

Malware Config

Targets

- Target
  
  8061bb999a0f5d3165742283001a7a68e7905718c928172343bf8456b69f268d.exe
- Size
  
  497KB
- MD5
  
  bea5c2c91e1fa97854c65ece18456b0e
- SHA1
  
  2ed560ed6d90b42e79da906625a03e743f742369
- SHA256
  
  8061bb999a0f5d3165742283001a7a68e7905718c928172343bf8456b69f268d
- SHA512
  
  1f67af2e4960b469742bdf55e43d04c9b00a87f31e1272cc7c857275837b3aa7f665cb47ecfb88f99d1a35feddde5d0a96283936ff45cdddb60be3d8caea7a50
- SSDEEP
  
  6144:LgVoyb9e9BhzGcIo6gCJv47raqMFdiksMi9agtuMf9opaiYOmDdnT:com47ciTt9agUG9oCOmD
Score

10^/10

rhysida credential_access defense_evasion discovery execution impact persistence ransomware spyware stealer
- Detect Rhysida ransomware
- Rhysida
  Rhysida is a ransomware that is written in C++ and discovered in 2023.
  ransomware rhysida
- Rhysida family
  rhysida
- Clears Windows event logs
  defense_evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (9765) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1