JCryptMalware
- Crypted
- daddycrypt
- foxxy
- iam_watching
- mafiaware666
- malki
- malwaredeveloper
- ncovid
- notstonks
- omero
- rip lmao
- vn_os
- wearefriends
Ransomware written in C#. Fortunately, all current versions of the MafiaWare666 ransomware are decryptable. The Threat Lab from Avast has developed a free decryption tool for this malware.From MISP Galaxy
Last reported 2 months ago, by Recorded Future2 reports
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1055Process Injection
“Their offerings often combine payload wrapping, in-memory execution, anti-analysis checks, process injection, persistence options, delivery packaging, and post-detection “cleaning” or re-crypting services.”
- T1055.004Asynchronous Procedure Call
“To terminate the thread, the malware queues an APC (asynchronous procedure call) to execute code in the context of the targeted thread.”
- T1110Brute Force
“For each process, it iterates over their handles, also using brute force, and checks if the underlying object corresponds to the client process.”
- T1222File and Directory Permissions Modification
“File and Directory Permissions Modification”
- T1480Execution Guardrails
“For instance, many crypting services include execution guardrails or methods for indicator suppression, such as ensuring execution fails in virtual environments or performing environmental scanning before execution to determine whether the payload is running in an analysis or san…”
- T1553.002Code Signing
“Code Signing”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Malware Crypting Services and the Threat Actors Who Sell Them“Crypted payloads increase the likelihood of successful malware execution and delayed detection, but they do not independently provide end-to-end intrusion capability.”
-
Shedding light on the ABYSSWORKER driver“Crypted Hearts: Exposing the HeartCrypt Packer-as-a-Service Operation, December 13, 2024.”
Indicators in its reports
named in the reports above- hxxps://github[.]com/elastic/protections-artifacts/blob/main/yara/rules/Windows_Rootkit_AbyssWorker.yarin 1 report
- 6a2a0f9c56ee9bf7…8cc5b1e8d050in 1 report
- b7703a59c39a0d2f…7551b8eed505in 1 report
- hxxps://github[.]com/wavestone-cdt/EDRSandblast/tree/masterin 1 report
- hxxps://github[.]com/myzxcg/RealBlindingEDRin 1 report
Copy these 5 indicators · defanged
Thanks — we review every report.