ShinraMalware
SHINRA ransomware is a variant of the Proton ransomware family, known for its malicious activities involving data encryption and demanding a ransom for data decryption. After encrypting files, the ransomware renames them with a sequence of random characters and appends the ". SHINRA3" extension to the filenames.From MISP Galaxy
Last reported 29 days ago, by SOCRadar1 report
ATT&CK techniques
6 of 19 · each with the sentence it comes from- T1012Query Registry
“…, the malware performs account discovery (T1087), process discovery (T1057), file and directory discovery (T1083), and registry queries (T1012) to map the environment and identify high-value targets for encryption and exfiltration.”
- T1057Process Discovery
“Once running with elevated privileges, the malware performs account discovery (T1087), process discovery (T1057), file and directory discovery (T1083), and registry queries (T1012) to map the environment and identify high-value targets for encryption and exfiltration.”
- T1059.001PowerShell
“The use of PowerShell is consistent with the MITRE ATT&CK technique T1059.001, though NCERT mapped to T1059.003 for this campaign.”
- T1059.003Windows Command Shell
“The use of PowerShell is consistent with the MITRE ATT&CK technique T1059.001, though NCERT mapped to T1059.003 for this campaign.”
- T1070.006Timestomp
“Timestomping (T1070.006): File timestamps are manipulated to complicate forensic timeline reconstruction.”
- T1074Data Staged
“T1074”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Dark Web Profile: Blue Locker Ransomware“…ssessed Blue Locker as “a variant of the Proton ransomware family, sharing similarities with previous strains including Limba, Zola, and Shinra.””
Indicators in its reports
named in the reports above- protonmail[.]comin 1 report
- d3cc6cc4538d57f2…377cf1d0fadcin 1 report
- e6bd4ed287d13362…96d5d9e95a33in 1 report
- 6eeb20cc709a18bf…244886bbfd2ein 1 report
- 515bd71a8b3c2bce…dcdcb8a91ed9in 1 report
- 6af349a30f95e01b87cd7dd4ddc8e3fein 1 report
- 7e1cc4d2e4b35b95…4b6f7f2783d1in 1 report
- xmpp[.]jpin 1 report
- shinra-encrypt-support[.]xyzin 1 report
- blue-decryptor[.]sitein 1 report
- backup-leaks[.]funin 1 report
- 185.225.69[.]140in 1 report
- 195.3.145[.]99in 1 report
- 91.243.113[.]21in 1 report
- 103.150.199[.]23in 1 report
- 185.180.197[.]34in 1 report
- 45.155.205[.]233in 1 report
- 84.54.52[.]83in 1 report
- 185.212.128[.]88in 1 report
- 176.123.2[.]209in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.