rhysida | 31f56688471fb06580d4a9f1a17c94f595866389a2edae29199b799e61911e70

General

Target
2026-07-15_0ff8959c84a195b3db4f3f40e7d819f1_coinminer_elex_rhysida
Size 353KB
Sample260716-cnc97sev9s
SHA256 31f56688471fb06580d4a9f1a17c94f595866389a2edae29199b799e61911e70
MD5 0ff8959c84a195b3db4f3f40e7d819f1
SHA1 41c512809943617a1b422e45ed8e822294d56320
SHA512 bd1aa9fb780ee4fca3b64c3441c647316a4734392044f289dedab7450ecec5b9bca3a651867b1e23679d56baa81560935b75019d9b1c9c3e5d0c0e976061ee6f
SSDEEP 6144:OeigHPKpV1hH/lRLIRsdyhFNnofZwnADhY+xlgVv3M:xigHUz9lRvyLtiwnZ+xKU
TLSH
T1F2747C0AFA8750F1DD1318B14243FABF5B24B702A430DF6ED698ED89EB33691711E265
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-15_0ff8959c84a195b3db4f3f40e7d819f1_coinminer_elex_rhysida
- Size 353KB
- SHA256 31f56688471fb06580d4a9f1a17c94f595866389a2edae29199b799e61911e70
- MD5 0ff8959c84a195b3db4f3f40e7d819f1
- SHA1 41c512809943617a1b422e45ed8e822294d56320
- SHA512 bd1aa9fb780ee4fca3b64c3441c647316a4734392044f289dedab7450ecec5b9bca3a651867b1e23679d56baa81560935b75019d9b1c9c3e5d0c0e976061ee6f
- SSDEEP 6144:OeigHPKpV1hH/lRLIRsdyhFNnofZwnADhY+xlgVv3M:xigHUz9lRvyLtiwnZ+xKU
- TLSH
  T1F2747C0AFA8750F1DD1318B14243FABF5B24B702A430DF6ED698ED89EB33691711E265
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution rhysida persistence ransomware spyware stealer
- Detect Rhysida ransomware
- Family: Rhysida
  Rhysida is a ransomware that is written in C++ and discovered in 2023.
  ransomware rhysida
- Clears Windows event logs
  defense_evasion ransomware
- Detects command variations typically used by ransomware
- Detects executables containing commands for clearing Windows Event Logs
- Renames multiple (10094) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2