rhysida

General

Target
Sigmanly_5f3ecd02a94cec2b62bfecd79f5a1d98
Size 497KB
Sample250413-qcldbswmt8
SHA256 b55ecbddcbed916481ad537807cd3e33cb71814be6ce8e03eb63b629ccb8c692
MD5 5f3ecd02a94cec2b62bfecd79f5a1d98
SHA1 2cd65d6d0cb10b8d061ee33133f0f98f86917265
SHA512 254949d3932a915394dec0eca359291baa8963e0cab55d28af02c678ce9841a3dad9b2d28e911f51655d8a52cf7d7379b446c0a2917b6e083abf95a1aa68dfee
SSDEEP 6144:rFoCbN9uRhQW8HnuYqWrJhN7L6aMFNYkS+D5gtuMf9opagj7T:IqnTp7N78Y5e5gUG9o/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  Sigmanly_5f3ecd02a94cec2b62bfecd79f5a1d98
- Size 497KB
- SHA256 b55ecbddcbed916481ad537807cd3e33cb71814be6ce8e03eb63b629ccb8c692
- MD5 5f3ecd02a94cec2b62bfecd79f5a1d98
- SHA1 2cd65d6d0cb10b8d061ee33133f0f98f86917265
- SHA512 254949d3932a915394dec0eca359291baa8963e0cab55d28af02c678ce9841a3dad9b2d28e911f51655d8a52cf7d7379b446c0a2917b6e083abf95a1aa68dfee
- SSDEEP 6144:rFoCbN9uRhQW8HnuYqWrJhN7L6aMFNYkS+D5gtuMf9opagj7T:IqnTp7N78Y5e5gUG9o/
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

rhysida credential_access defense_evasion discovery execution impact persistence ransomware spyware stealer
- Detect Rhysida ransomware
- Rhysida
  Rhysida is a ransomware that is written in C++ and discovered in 2023.
  ransomware rhysida
- Rhysida family
  rhysida
- Clears Windows event logs
  defense_evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (9711) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1