Defray777
Description
(Palo Alto) Defray777 is an elusive family of ransomware also known as Ransom X and RansomExx. Although it has recently been covered in the news as a new family, it has been in use since at least 2018 and is responsible for a number of high-profile ransomware incidents — as detailed in the articles we linked to.
Defray777 runs entirely in memory, which is why there have been so few publicly discussed samples to date. In several recent incidents, Defray777 was loaded into memory and executed by Cobalt Strike, which was delivered by the Vatet loader.
Names
| Name |
|---|
| Defray777 |
| Defray |
| Defray 2018 |
| Target777 |
| Ransom X |
| RansomExx |
| Glushkov |
Category
Malware
Type
- Ransomware
- Big Game Hunting
Information
- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/
- https://www.trendmicro.com/vinfo/pl/security/news/cyber-attacks/defray-ransomware-sets-sights-on-healthcare-and-other-industries
- https://www.csoonline.com/article/3604599/sprite-spider-emerging-as-one-of-the-most-destructive-ransomware-threat-actors.html
- https://blogs.vmware.com/networkvirtualization/2021/03/deconstructing-defray777.html/
- https://www.cybereason.com/blog/cybereason-vs.-ransomexx-ransomware
- https://blogs.blackberry.com/en/2017/09/cylance-vs-defray-ransomware
- https://securityintelligence.com/posts/ransomexx-upgrades-rust/
Malpedia
Alienvault Otx
Other Information
Uuid
ec6a3a6f-e491-4831-a92f-7fd13b93331f
Last Card Change
2022-12-28