rhysida

General

Target

Sigmanly_fac561bb0f072d29fe6f8ee6072c905a
Size

353KB
Sample

250414-s7sf8szny3
MD5

fac561bb0f072d29fe6f8ee6072c905a
SHA1

da29dc6bd9ba38d11d46665e42bed7d5c35f48fc
SHA256

3d2013c2ba0aa1c0475cab186ddf3d9005133fe5f88b5d8604b46673b96a40d8
SHA512

0b5dcabd10c9cadbe6b98c3814a73a3d9f285578869821493d6cd7a87d1cdd1144de7a77dce1360b95c4ef0f96895a6f04c9dbbf15a3177866e9c2883b35727d
SSDEEP

6144:heigHPKpV1hH/lRLIRsdyhFNnofZwnADhY+xlgVv3M:UigHUz9lRvyLtiwnZ+xKU

Score

10^/10

Malware Config

Targets

- Target
  
  Sigmanly_fac561bb0f072d29fe6f8ee6072c905a
- Size
  
  353KB
- MD5
  
  fac561bb0f072d29fe6f8ee6072c905a
- SHA1
  
  da29dc6bd9ba38d11d46665e42bed7d5c35f48fc
- SHA256
  
  3d2013c2ba0aa1c0475cab186ddf3d9005133fe5f88b5d8604b46673b96a40d8
- SHA512
  
  0b5dcabd10c9cadbe6b98c3814a73a3d9f285578869821493d6cd7a87d1cdd1144de7a77dce1360b95c4ef0f96895a6f04c9dbbf15a3177866e9c2883b35727d
- SSDEEP
  
  6144:heigHPKpV1hH/lRLIRsdyhFNnofZwnADhY+xlgVv3M:UigHUz9lRvyLtiwnZ+xKU
Score

10^/10

rhysida credential_access defense_evasion discovery execution persistence ransomware spyware stealer
- Detect Rhysida ransomware
- Rhysida
  Rhysida is a ransomware that is written in C++ and discovered in 2023.
  ransomware rhysida
- Rhysida family
  rhysida
- Clears Windows event logs
  defense_evasion ransomware
- Renames multiple (9700) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1