General
- Target WinSCP-6.5.5-Setup.exe
- Size 11.9MB
- Sample260209-ewkelabw4f
- SHA256 0e19ed09b16291fba9a694e9474ba46c8931834af4f7842ea1d15d908db6de68
Malware Config
Targets
-
- Target WinSCP-6.5.5-Setup.exe
- Size 11.9MB
- SHA256 0e19ed09b16291fba9a694e9474ba46c8931834af4f7842ea1d15d908db6de68
Score10/10-
Detect Rhysida ransomware
-
Rhysida
Rhysida is a ransomware that is written in C++ and discovered in 2023.
-
Rhysida family
-
Clears Windows event logs
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (10164) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Drops startup file
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
MITRE ATT&CK Enterprise v16
Defense Evasion
Direct Volume Access
1Indicator Removal
3Clear Windows Event Logs
1File Deletion
2Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1