EnigmaMalware
RansomwareFrom MISP Galaxy
Last reported 16 days ago, by Cisco Talos4 reports
ATT&CK techniques
6 of 11 · each with the sentence it comes from- T1036Masquerading
“Masquerading as Russian hackers”
- T1014Rootkit
“eb.sys, a rootkit (PoC)”
- T1027Obfuscated Files or Information
“T1027”
- T1036.001Invalid Code Signature
“T1036.001”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: Windows Command Shell”
- T1059.003Windows Command Shell
“T1059.003”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware“…ception by including approximately 80 tiny sections in the binary named after well-known protector frameworks (e.g., Themida, VMProtect, Enigma, UPX, Denuvo).”
-
GentleKiller: análisis del framework EDR killer de Gentlemen“Se aplica protección binaria avanzada (Enigma o Themida) a una proporción significativa de las muestras detectadas.”
-
Killing me gently: Inside Gentlemen’s EDR killer framework“Advanced binary protection (Enigma or Themida) is applied to a significant portion of the samples we detected.”
-
LAZARUS ARISEN“To protect their executables, hackers used Enigma Protector, a commercial product, which was created by a Russian software developer.”
Indicators in its reports
named in the reports above- 8ae6bd18b129061f…84cf0383c75din 2 reports
- ba914fe77b177b45…4765c510a074in 2 reports
- d605994fc72a2bb5…b9170eca73a2in 2 reports
- b0b912a3fd1c05d7…2880004021a1in 2 reports
- 5aa3124e5c4921e5…71da21b07da3in 2 reports
- 7556ae58c215b824…6c7a8f0fdd1ain 2 reports
- 331879f5eec8892b…1bad0bf63bd6in 2 reports
- f11aebccb9a86a7e…697f233c255fin 2 reports
- ef9cd06683159397…4e6eaad96ebain 2 reports
- 711ef22152699703…47c91680bbe2in 2 reports
- 68fec379f2ae76c3…50cea1d06990in 2 reports
- a11ee9cdc59e5caa…104f3ad68e62in 2 reports
- 96f0dbf52aed0afd…04b674f7358ein 2 reports
- 2f86898528c6cab3…a0c029b73950in 2 reports
- 9ad51ad97c01e97a…785e0f6320a8in 2 reports
- a19117175dbc9ba4…e299a2e32192in 2 reports
- 12500f6c87ce6271…468d15c14223in 2 reports
- d29670e684e40ddc…bc96737035b6in 2 reports
- 56bee9df5833a637…98b0812fe643in 2 reports
- cf4d74df17a91b4a…ec5d8fa93a01in 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.