PrestigeMalware
According to PCrisk, Prestige is ransomware - malware that prevents victims from accessing (opening) their files by encrypting them. Additionally, Prestige appends the ".enc" extension to filenames and drops the "README" file containing a ransom note. An example of how this ransomware modifies filenames: it renames "1.jpg" to "1.jpg.enc", "2.png" to "2.png.enc", and so forth.From MISP Galaxy
Last reported 8 months ago, by ESET WeLiveSecurity1 report
ATT&CK techniques
6 of 18 · each with the sentence it comes from- T1003OS Credential Dumping
“OS Credential Dumping: LSASS Memory”
- T1003.001LSASS Memory
“T1003.001”
- T1053Scheduled Task/Job
“Scheduled Task/Job: Scheduled Task”
- T1053.005Scheduled Task
“T1053.005”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: PowerShell”
- T1059.001PowerShell
“T1059.001”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
DynoWiper update: Technical analysis and attribution“…ng, in roughly chronological order, HermeticWiper, HermeticRansom, CaddyWiper, DoubleZero, ARGUEPATCH, ORCSHRED, SOLOSHRED, AWFULSHRED, Prestige ransomware, RansomBoggs ransomware, SDelete-based wipers, BidSwipe, ROARBAT, SwiftSlicer, NikoWiper, SharpNikoWiper, ZEROLOT, Sting wip…”
Indicators in its reports
named in the reports above- 31.172.71[.]5in 1 report
- progamevl[.]ruin 1 report
- 472ca448f82a7ff6…86fd7c38b631in 1 report
- 4f8e9336a784a196…8fa54f6a92e2in 1 report
- 4ec3c90846af6b79…3fd21f6d4cf6in 1 report
- 86596a5c5b05a8bf…4702f7d0d61bin 1 report
- 69ede7e341fd26fa…80cb44778d93in 1 report
- 9ec4c38394ea2048…6de48d8bd4e8in 1 report
- 410c8a57fe6e09ed…e4797ca80a19in 1 report
Copy these 9 indicators · defanged
Thanks — we review every report.