jigsaw | hxxps://github[.]com/ytisf/theZoo/raw/refs/heads/master/malware/Binaries/Ransomware[.]Jigsaw/Ransomware[.]Jigsaw[.]zip

- Target
  https://github.com/ytisf/theZoo/raw/refs/heads/master/malware/Binaries/Ransomware.Jigsaw/Ransomware.Jigsaw.zip
Score

10^/10

discovery jigsaw persistence ransomware
- Family: Jigsaw Ransomware
  Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
  ransomware jigsaw
- Renames multiple (219) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral1