hades | hxxps://github[.]com/Cryakl/Ransomware-Database

General

Target
https://github.com/Cryakl/Ransomware-Database
Sample251108-vm41msskgk

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Links\HELP_DECRYPT_YOUR_FILES.txt

Ransom Note

Oops All Of your important files were encrypted Like document pictures videos etc.. Don't worry, you can return all your files! All your files, documents, photos, databases and other important files are encrypted by a strong encryption. How to recover files? RSA is a asymmetric cryptographic algorithm, you need one key for encryption and one key for decryption so you need private key to recover your files. It’s not possible to recover your files without private key. The only method of recovering files is to purchase an unique private key.Only we can give you this key and only we can recover your files. What guarantees you have? As evidence, you can send us 1 file to decrypt by email We will send you a recovery file Prove that we can decrypt your file Please You must follow these steps carefully to decrypt your files: Send $500 worth of bitcoin to wallet: bc1q6ug0vrxz66d564qznclu9yyyvn6zurskezmt64 after payment,we will send you Decryptor software contact email: [email protected] Your personal ID: tWkPtKLXGMYnREnbLATFeGWiuU0KTl6EXzftvp5C5SD8R4PEbIdmqmekDW1UN7RtnZhB5YjgHEp4GZbvmmWdijwb6As5qO4t24Ae4VUil4nEVnkegyXoQRnPFkZ9FANn/1lMEyYxGvBPd+bYqfV8trhvsa63W0bS2MwQ1ExliKo=

Emails

[email protected]

Targets

- Target
  https://github.com/Cryakl/Ransomware-Database
Score

10^/10

adware credential_access cryptone defense_evasion discovery execution hades rhysida impact packer persistence ransomware spyware stealer trojan upx
- Detect Rhysida ransomware
- Hades Ransomware
  Ransomware family attributed to Evil Corp APT first seen in late 2020.
  ransomware hades
- Hades family
  hades
- Hades payload
- Rhysida
  Rhysida is a ransomware that is written in C++ and discovered in 2023.
  ransomware rhysida
- Rhysida family
  rhysida
- UAC bypass
  defense_evasion trojan
- CryptOne packer
  Detects CryptOne packer defined in NCC blogpost.
  cryptone packer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (103) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Legitimate hosting services abused for malware hosting/C2
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1