Loading malware…
FIVEHANDS is a Windows ransomware family related to DeathRansom and HelloKitty, associated with the financially motivated threat cluster UNC2447. It has been deployed against organizations in North America and Europe following exploitation of CVE-2021-20016 in SonicWall SMA 100 Series VPN appliances, including activity before patches became available in February 2021. FIVEHANDS intrusions have also involved the SombRAT remote access trojan and legitimate reconnaissance and remote-administration tools.
FIVEHANDS encrypts victim files using the NTRUEncrypt public-key encryption scheme with an embedded public key and places ransom notes in affected directories. It enumerates network shares and mounted drives, supports command-line arguments that restrict encryption to specified directories, and avoids encrypting key system files. To inhibit recovery, it uses Windows Management Instrumentation to enumerate and delete Volume Shadow Copies and also encrypts files associated with system recovery. Its loader decrypts an embedded ransomware payload in memory using an operator-supplied key, validates the decoded executable, and executes it. Operators have used PsExec to distribute and launch the ransomware remotely with system privileges.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat.
One of the most prolific and successful Conti affiliates—and the one responsible for developing the “Conti Manual” leaked in August 2021—is tracked as DEV-0230. This activity group also developed and deployed the FiveHands and HelloKitty ransomware payloads...
15 distinct techniques documented for this family, organized by ATT&CK tactic.
TRU observed at least two cybercrime operations utilizing the same Cobalt Strike infrastructure, during 2021 and into 2022, and both operations are leveraging SonicWall exploits
it uses Windows Management Instrumentation (WMI) to enumerate Volume Shadow copies using the command “ select * from Win32_ShadowCopy” and then deletes copies by ID (Win32_ShadowCopy.ID).
APT19 downloaded and launched code within a SCT file; APT32 used COM scriptlets to download Cobalt Strike beacons; APT37 used Ruby scripts to execute payloads; ArcaneDoor included the adversary executing command line interface (CLI) commands.
Dragonfly has used the command line for execution. Empire uses a command-line interface to interact with systems. StarProxy has used the command line for execution of commands.
The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.
Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'
In these cases, the threat actors were able to delete cloud-stored backups prior to ransomware deployment.
To thwart the recovery of the data, it uses Windows Management Instrumentation (WMI) to enumerate Volume Shadow copies using the command “ select * from Win32_ShadowCopy” and then deletes copies by ID (Win32_ShadowCopy.ID).
The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.
The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.
APT1 listed connected network shares. APT32 used the net view command to show all shares available, including the administrative shares such as C$ and ADMIN$. APT41 used the net share command as part of network reconnaissance.
"...multiple security flaws... impact SMA 200, 210, 400, 410, and 500v appliances even when the web application firewall (WAF) is enabled."
Customization choices include legitimate certificates, non-standard CS ports, and malleable Command and Control (C2).
Vice Society is known for its extortion tactics, encrypting devices and demanding a ransom.
Akira will delete system volume shadow copies via PowerShell commands. Avaddon deletes backups and shadow copies using native system tools. Babuk has the ability to delete shadow volumes using vssadmin.exe delete shadows /all /quiet. BlackCat can delete shadow copies using vssadmin.exe delete shadows /all /quiet and wmic.exe Shadowcopy Delete; it can also modify the boot loader using bcdedit /set {default} recoveryenabled No.
42 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
34 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.