MITRE ATT&CKsoftware (malware)
S0618 FIVEHANDS
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.1
- Created
- 2021-06-04
Description
FIVEHANDS is a customized version of DEATHRANSOM ransomware written in C++. FIVEHANDS has been used since at least 2021, including in Ransomware-as-a-Service (RaaS) campaigns, sometimes along with SombRAT.
Related
Uses · MITRE ATT&CK (8)
- T1027.013 Encrypted/Encoded File sub-technique
- T1490 Inhibit System Recovery technique
- T1486 Data Encrypted for Impact technique
- T1135 Network Share Discovery technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1047 Windows Management Instrumentation technique
- T1059 Command and Scripting Interpreter technique
- T1083 File and Directory Discovery technique
References
- https://research.nccgroup.com/2021/06/15/handy-guide-to-a-new-fivehands-ransomware-variant/ NCC Group Fivehands June 2021
- https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html FireEye FiveHands April 2021