FIVEHANDS — Malware Profile

FIVEHANDS is a customized version of DEATHRANSOM ransomware written in C++. FIVEHANDS has been used since at least 2021, including in Ransomware-as-a-Service (RaaS) campaigns, sometimes along with SombRAT.

MITRE ATT&CK techniques (8)

• T1027.013 Encrypted/Encoded File
• T1047 Windows Management Instrumentation
• T1059 Command and Scripting Interpreter
• T1083 File and Directory Discovery
• T1135 Network Share Discovery
• T1140 Deobfuscate/Decode Files or Information
• T1486 Data Encrypted for Impact
• T1490 Inhibit System Recovery

Read the full analysis on IntelFusions