Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
12 distinct techniques documented for this family, organized by ATT&CK tactic.
Lastly, to cleanup, the application, system, and security event logs are erased ("OpenEventLogA" and "ClearEventLogA").
Using the access token handle, "GetTokenInformation" is called to identify the user account information tied to the token, most notably the SID... The user account info will be used to check for administrative rights.
"RmGetList" [is] used to check if the target files are locked by any other processes.
Files are then iterated through using "FindFirstFileW" and "FindNextFileW", and checked against a file blacklist... before being stored in a list to be used in the encryption process.
The fifth thread starts the actual file encryption process with a call to "startEncrypt"... The target files are then finally encrypted.
if a lock exists, a handle is opened to the process, and the process is terminated, using "OpenProcess" and "TerminateProcess"... "taskkill" to kill processes of common AV & EDR products and backup software. | The second thread that is created, handles service manipulation... using "OpenServiceA"... "QueryServiceStatusEx"... "EnumDependentServicesA"... and make modifications to the service, such as stopping it, with "ControlService".
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
DoNex is a financially motivated ransomware group active since early 2024, targeting organizations in the US and Europe. A decryptor is available for victims.
Ransomware that encrypts local and network-share files, drops a ransom note, kills processes locking target files, attempts to stop services, clears event logs, empties recycle bins, and forces a hard restart after cleanup.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.