CACTUS ransomware | Cyber Threat Intelligence | Kroll
Tags
Common Information
| Type | Value |
|---|---|
| UUID | a08073db-8236-4e67-b71a-011a284f1597 |
| Fingerprint | a4610c136d3b96ee |
| Analysis status | DONE |
| Considered CTI value | 2 |
| Text language | |
| Published | May 10, 2023, midnight |
| Added to db | June 1, 2023, 10:58 a.m. |
| Last updated | Nov. 17, 2024, 6:56 p.m. |
| Headline | CACTUS Ransomware: Prickly New Variant Evades Detection |
| Title | CACTUS ransomware | Cyber Threat Intelligence | Kroll |
| Detected Hints/Tags/Attributes | 139/2/66 |
Source URLs
URL Provider
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | Domain | 10 | decode.py |
|
| Details | Domain | 54 | re.search |
|
| Details | Domain | 1 | extracted.group |
|
| Details | File | 193 | ntuser.dat |
|
| Details | File | 367 | readme.txt |
|
| Details | File | 249 | schtasks.exe |
|
| Details | File | 1 | %programdata%\sshd\sshd.exe |
|
| Details | File | 1 | %programdata%\sshd\ssh.exe |
|
| Details | File | 51 | install.bat |
|
| Details | File | 15 | ips.txt |
|
| Details | File | 41 | users.txt |
|
| Details | File | 1 | c:\users\public\ad.txt |
|
| Details | File | 2 | psnmap.ps1 |
|
| Details | File | 269 | msiexec.exe |
|
| Details | File | 1 | c:\windows\best_uninstalltool.exe |
|
| Details | File | 1 | c:\windows\f2.bat |
|
| Details | File | 2 | f1.bat |
|
| Details | File | 6 | totalexec.ps1 |
|
| Details | File | 2 | f2.bat |
|
| Details | File | 1208 | powershell.exe |
|
| Details | File | 1 | c:\windows\f1.bat |
|
| Details | File | 38 | 7.exe |
|
| Details | File | 1 | c:\windows\7.exe |
|
| Details | File | 1 | c:\windows\ .7z |
|
| Details | File | 1 | c:\windows\ .exe |
|
| Details | File | 1 | a12b-e4fg-c12g-zkc2.exe |
|
| Details | File | 1 | c:\programdata\abc1-d2ef-gh3i-4jkl.exe |
|
| Details | File | 9 | c:\programdata\ntuser.dat |
|
| Details | File | 10 | decode.py |
|
| Details | File | 39 | anydesk.exe |
|
| Details | File | 1 | psnb.ps1 |
|
| Details | File | 137 | conhost.exe |
|
| Details | md5 | 1 | d9f15227fefb98ba69d98542fbe7e568 |
|
| Details | md5 | 1 | 3adc612b769a2b1d08b50b1fb5783bcf |
|
| Details | md5 | 1 | be7b13aee7b510b052d023dd936dc32f |
|
| Details | md5 | 1 | 26f3a62d205004fbc9c76330c1c71536 |
|
| Details | md5 | 1 | d5e5980feb1906d85fbd2a5f2165baf7 |
|
| Details | md5 | 1 | 78aea93137be5f10e9281dd578a3ba73 |
|
| Details | IPv4 | 1441 | 127.0.0.1 |
|
| Details | IPv4 | 2 | 163.123.142.213 |
|
| Details | MITRE ATT&CK Techniques | 542 | T1190 |
|
| Details | MITRE ATT&CK Techniques | 59 | T1021.004 |
|
| Details | MITRE ATT&CK Techniques | 275 | T1053.005 |
|
| Details | MITRE ATT&CK Techniques | 119 | T1049 |
|
| Details | MITRE ATT&CK Techniques | 99 | T1087.002 |
|
| Details | MITRE ATT&CK Techniques | 243 | T1018 |
|
| Details | MITRE ATT&CK Techniques | 179 | T1087 |
|
| Details | MITRE ATT&CK Techniques | 141 | T1219 |
|
| Details | MITRE ATT&CK Techniques | 152 | T1090 |
|
| Details | MITRE ATT&CK Techniques | 298 | T1562.001 |
|
| Details | MITRE ATT&CK Techniques | 86 | T1136 |
|
| Details | MITRE ATT&CK Techniques | 125 | T1555.003 |
|
| Details | MITRE ATT&CK Techniques | 289 | T1003 |
|
| Details | MITRE ATT&CK Techniques | 160 | T1021.001 |
|
| Details | MITRE ATT&CK Techniques | 50 | T1072 |
|
| Details | MITRE ATT&CK Techniques | 100 | T1567.002 |
|
| Details | MITRE ATT&CK Techniques | 160 | T1027.002 |
|
| Details | MITRE ATT&CK Techniques | 472 | T1486 |
|
| Details | MITRE ATT&CK Techniques | 627 | T1027 |
|
| Details | MITRE ATT&CK Techniques | 118 | T1570 |
|
| Details | MITRE ATT&CK Techniques | 695 | T1059 |
|
| Details | MITRE ATT&CK Techniques | 111 | T1119 |
|
| Details | Windows Registry Key | 164 | HKLM\SOFTWARE\Microsoft\Windows |
|
| Details | Windows Registry Key | 98 | HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System |
|
| Details | Windows Registry Key | 49 | HKLM\Software\Microsoft\Windows |
|
| Details | Windows Registry Key | 6 | HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce |