Loading malware…
HiddenTear is an open-source proof-of-concept ransomware project for Microsoft Windows that has been repeatedly repurposed into operational ransomware by criminal actors. It encrypts victim files and is designed to present ransom demands for data recovery. Its publicly available code has lowered the barrier to entry for ransomware development, leading to numerous modified, packed, and obfuscated variants, including ransomware families such as Ranion and Sorry HT. HiddenTear-derived payloads have been delivered through malicious documents in COVID-19-themed phishing campaigns. Individual derivatives may add their own delivery, persistence, evasion, and post-encryption behaviors; these are not inherent to every HiddenTear-based sample.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
No less than 31,000 malware samples, including Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos RAT, njRAT, and artifacts bearing HiddenTear ransomware signatures, have communicated with Sable Squirrel's infrastructure.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
Loading the binary into JustDecompileIt we notice that it was crypted by something called Aika. The Assembly Information also gives away that ConfuserEx is involved as well.
"A subset of these same domains also operate as malware C2. We identified over 31,000 malware samples connecting to Sable Squirrel domains... In such cases, a human visitor sees a live football streaming site while an infected device uses the same domain as a control channel."
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware family for which samples were linked to Sable Squirrel infrastructure.
Ransomware referenced as using repurposed expired domains as command-and-control/supporting infrastructure.
Ransomware family whose signatures were found among malware samples communicating with Sable Squirrel infrastructure.
Ransomware family whose signatures were found in malware samples communicating with Sable Squirrel domain infrastructure.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.