General
- Target israbye.exe
- Size 6.7MB
- Sample260706-pylqjsft5x
- SHA256 5a209e40e0659b40d3d20899c00757fa33dc00ddcac38a3c8df004ab9051de0d
Score
10/10
Malware Config
Targets
-
- Target israbye.exe
- Size 6.7MB
- SHA256 5a209e40e0659b40d3d20899c00757fa33dc00ddcac38a3c8df004ab9051de0d
Score10/10Detects IsraBye ransomware
Family: IsraBye
IsraBye is a Windows ransomware written in C#.
Renames multiple (1115) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Drops startup file
Executes dropped EXE
Adds Run key to start application
Drops desktop.ini file(s)
Sets desktop wallpaper using registry
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1