General
- Target israbye.exe
- Size 6.7MB
- Sample260706-pylqjsft5x
- SHA256 5a209e40e0659b40d3d20899c00757fa33dc00ddcac38a3c8df004ab9051de0d
Score
10/10
Malware Config
Targets
-
- Target israbye.exe
- Size 6.7MB
- SHA256 5a209e40e0659b40d3d20899c00757fa33dc00ddcac38a3c8df004ab9051de0d
Score10/10-
Detects IsraBye ransomware
-
Family: IsraBye
IsraBye is a Windows ransomware written in C#.
-
Renames multiple (1115) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Sets desktop wallpaper using registry
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1