General
- Target 2026-06-09_14a5bd71c28ff0c001e5caa703dece5a_coinminer_rhysida
- Size 908KB
- Sample260609-r54aaacs6x
- SHA256 6f810084ecb920565e9bcdea711bcc1e788d8372727725b0fc5cb2cc8909ea62
Score
10/10
Malware Config
Targets
-
- Target 2026-06-09_14a5bd71c28ff0c001e5caa703dece5a_coinminer_rhysida
- Size 908KB
- SHA256 6f810084ecb920565e9bcdea711bcc1e788d8372727725b0fc5cb2cc8909ea62
Score10/10-
Detects Rhysida ransom note
-
Family: Rhysida
Rhysida is a ransomware that is written in C++ and discovered in 2023.
-
Renames multiple (9993) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Deletes itself
-
Drops startup file
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.