FIVEHANDS — Malware Profile
FIVEHANDS is a customized version of DEATHRANSOM ransomware written in C++. FIVEHANDS has been used since at least 2021, including in Ransomware-as-a-Service (RaaS) campaigns, sometimes along with SombRAT.
MITRE ATT&CK techniques (8)
- T1027.013 Encrypted/Encoded File
- T1047 Windows Management Instrumentation
- T1059 Command and Scripting Interpreter
- T1083 File and Directory Discovery
- T1135 Network Share Discovery
- T1140 Deobfuscate/Decode Files or Information
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery