{
	"id": "b7708bc6-c5b4-4b32-a437-d9bab7f233f3",
	"created_at": "2026-04-06T01:30:49.788712Z",
	"updated_at": "2026-04-10T03:37:51.348302Z",
	"deleted_at": null,
	"sha1_hash": "c93fb88ea6bff50befe7d98d1381cc0b5d9ceefe",
	"title": "FiveHands (Malware Family)",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 76611,
	"plain_text": "FiveHands (Malware Family)\r\nBy Fraunhofer FKIE\r\nArchived: 2026-04-06 00:51:50 UTC\r\nFiveHands\r\naka: Thieflock\r\nActor(s): [Unnamed group]\r\nThere is no description at this point.\r\nReferences\r\n2022-09-06 ⋅ CISA ⋅ CISA, FBI, MS-ISAC, US-CERT\r\nAlert (AA22-249A) #StopRansomware: Vice Society\r\nCobalt Strike Empire Downloader FiveHands HelloKitty SystemBC Zeppelin\r\n2022-08-30 ⋅ eSentire ⋅ eSentire Threat Response Unit (TRU)\r\nHacker Infrastructure Used in Cisco Breach Discovered Attacking a Top Workforce Management Corporation\r\n\u0026 an Affiliate of Russia’s Evil Corp Gang Suspected, Reports eSentire\r\nCobalt Strike FiveHands UNC2447\r\n2022-05-09 ⋅ Microsoft ⋅ Microsoft 365 Defender Threat Intelligence Team, Microsoft Threat Intelligence Center (MSTIC)\r\nRansomware-as-a-service: Understanding the cybercrime gig economy and how to protect yourself\r\nAnchorDNS BlackCat BlackMatter Conti DarkSide HelloKitty Hive LockBit REvil FAKEUPDATES Griffon\r\nATOMSILO BazarBackdoor BlackCat BlackMatter Blister Cobalt Strike Conti DarkSide Emotet FiveHands\r\nGozi HelloKitty Hive IcedID ISFB JSSLoader LockBit LockFile Maze NightSky Pandora Phobos Phoenix\r\nLocker PhotoLoader QakBot REvil Rook Ryuk SystemBC TrickBot WastedLocker BRONZE STARLIGHT\r\n2022-03-21 ⋅ eSentire ⋅ eSentire Threat Response Unit (TRU)\r\nConti Affiliate Exposed: New Domain Names, IP Addresses and Email Addresses Uncovered\r\nHelloKitty BazarBackdoor Cobalt Strike Conti FiveHands HelloKitty IcedID\r\n2021-11-30 ⋅ Bleeping Computer ⋅ Ionut Ilascu\r\nYanluowang ransomware operation matures with experienced affiliates\r\nFiveHands\r\nhttps://malpedia.caad.fkie.fraunhofer.de/details/win.fivehands\r\nPage 1 of 2\n\n2021-11-30 ⋅ Symantec ⋅ Symantec Threat Hunter Team\r\nYanluowang: Further Insights on New Ransomware Threat\r\nBazarBackdoor Cobalt Strike FiveHands\r\n2021-08-15 ⋅ Symantec ⋅ Threat Hunter Team\r\nThe Ransomware Threat\r\nBabuk BlackMatter DarkSide Avaddon Babuk BADHATCH BazarBackdoor BlackMatter Clop Cobalt Strike\r\nConti DarkSide DoppelPaymer Egregor Emotet FiveHands FriedEx Hades IcedID LockBit Maze MegaCortex\r\nMimiKatz QakBot RagnarLocker REvil Ryuk TrickBot WastedLocker\r\n2021-06-28 ⋅ CrowdStrike ⋅ Alexandru Ghita\r\nNew Ransomware Variant Uses Golang Packer\r\nFiveHands HelloKitty\r\n2021-06-15 ⋅ NCC Group ⋅ Michael Matthews, NCC RIFT, William Backhouse\r\nHandy guide to a new Fivehands ransomware variant\r\nFiveHands\r\n2021-05-06 ⋅ CISA ⋅ CISA\r\nAnalysis Report: FiveHands Ransomware\r\nFiveHands\r\n2021-05-06 ⋅ CISA ⋅ CISA\r\nMAR-10324784-1.v1: FiveHands Ransomware\r\nFiveHands\r\n2021-05-03 ⋅ Rewterz Information Security ⋅ Rewterz Information Security\r\nRewterz Threat Alert – Financially Motivated Aggressive Group Carrying Out Ransomware Campaigns –\r\nActive IOCs\r\nFiveHands SombRAT UNC2447\r\n2021-04-29 ⋅ FireEye ⋅ Justin Moore, Raymond Leong, Tyler McLellan\r\nUNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat\r\nCobalt Strike FiveHands HelloKitty\r\nThere is no Yara-Signature yet.\r\nSource: https://malpedia.caad.fkie.fraunhofer.de/details/win.fivehands\r\nhttps://malpedia.caad.fkie.fraunhofer.de/details/win.fivehands\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://malpedia.caad.fkie.fraunhofer.de/details/win.fivehands"
	],
	"report_names": [
		"win.fivehands"
	],
	"threat_actors": [
		{
			"id": "c1f1d9ce-ad31-49db-9f82-cc0dd12374da",
			"created_at": "2023-01-06T13:46:39.006986Z",
			"updated_at": "2026-04-10T02:00:03.17886Z",
			"deleted_at": null,
			"main_name": "[Unnamed group]",
			"aliases": [],
			"source_name": "MISPGALAXY:[Unnamed group]",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "8670f370-1865-4264-9a1b-0dfe7617c329",
			"created_at": "2022-10-25T16:07:23.69953Z",
			"updated_at": "2026-04-10T02:00:04.716126Z",
			"deleted_at": null,
			"main_name": "Hades",
			"aliases": [
				"Operation TrickyMouse"
			],
			"source_name": "ETDA:Hades",
			"tools": [
				"Brave Prince",
				"Gold Dragon",
				"GoldDragon",
				"Lovexxx",
				"Olympic Destroyer",
				"Running RAT",
				"RunningRAT",
				"SOURGRAPE",
				"running_rat"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "610a7295-3139-4f34-8cec-b3da40add480",
			"created_at": "2023-01-06T13:46:38.608142Z",
			"updated_at": "2026-04-10T02:00:03.03764Z",
			"deleted_at": null,
			"main_name": "Cobalt",
			"aliases": [
				"Cobalt Group",
				"Cobalt Gang",
				"GOLD KINGSWOOD",
				"COBALT SPIDER",
				"G0080",
				"Mule Libra"
			],
			"source_name": "MISPGALAXY:Cobalt",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "065b7ea2-5920-4270-824e-94ea8a79d197",
			"created_at": "2023-12-08T02:00:05.747632Z",
			"updated_at": "2026-04-10T02:00:03.492858Z",
			"deleted_at": null,
			"main_name": "UNC2447",
			"aliases": [],
			"source_name": "MISPGALAXY:UNC2447",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "50068c14-343c-4491-b568-df41dd59551c",
			"created_at": "2022-10-25T15:50:23.253218Z",
			"updated_at": "2026-04-10T02:00:05.234464Z",
			"deleted_at": null,
			"main_name": "Indrik Spider",
			"aliases": [
				"Indrik Spider",
				"Evil Corp",
				"Manatee Tempest",
				"DEV-0243",
				"UNC2165"
			],
			"source_name": "MITRE:Indrik Spider",
			"tools": [
				"Mimikatz",
				"PsExec",
				"Dridex",
				"WastedLocker",
				"BitPaymer",
				"Cobalt Strike"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "a6814184-2133-4520-b7b3-63e6b7be2f64",
			"created_at": "2025-08-07T02:03:25.019385Z",
			"updated_at": "2026-04-10T02:00:03.859468Z",
			"deleted_at": null,
			"main_name": "GOLD VICTOR",
			"aliases": [
				"DEV-0832 ",
				"STAC5279 ",
				"Vanilla Tempest ",
				"Vice Society",
				"Vice Spider "
			],
			"source_name": "Secureworks:GOLD VICTOR",
			"tools": [
				"Advanced IP Scanner",
				"Advanced Port Scanner",
				"HelloKitty ransomware",
				"INC ransomware",
				"MEGAsync",
				"Neshta",
				"PAExec",
				"PolyVice ransomware",
				"PortStarter",
				"PsExec",
				"QuantumLocker ransomware",
				"Rhysida ransomware",
				"Supper",
				"SystemBC",
				"Zeppelin ransomware"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "b296f34c-c424-41da-98bf-90312a5df8ef",
			"created_at": "2024-06-19T02:03:08.027585Z",
			"updated_at": "2026-04-10T02:00:03.621193Z",
			"deleted_at": null,
			"main_name": "GOLD DRAKE",
			"aliases": [
				"Evil Corp",
				"Indrik Spider ",
				"Manatee Tempest "
			],
			"source_name": "Secureworks:GOLD DRAKE",
			"tools": [
				"BitPaymer",
				"Cobalt Strike",
				"Covenant",
				"Donut",
				"Dridex",
				"Hades",
				"Koadic",
				"LockBit",
				"Macaw Locker",
				"Mimikatz",
				"Payload.Bin",
				"Phoenix CryptoLocker",
				"PowerShell Empire",
				"PowerSploit",
				"SocGholish",
				"WastedLocker"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "f63c346d-18c8-4821-a56d-fefb1ad7ed5d",
			"created_at": "2022-10-25T16:07:23.42507Z",
			"updated_at": "2026-04-10T02:00:04.593122Z",
			"deleted_at": null,
			"main_name": "Bronze Starlight",
			"aliases": [
				"Cinnamon Tempest",
				"DEV-0401",
				"HighGround",
				"Operation ChattyGoblin",
				"SLIME34"
			],
			"source_name": "ETDA:Bronze Starlight",
			"tools": [
				"Agent.dhwf",
				"Agentemis",
				"AtomSilo",
				"Cobalt Strike",
				"CobaltStrike",
				"Destroy RAT",
				"DestroyRAT",
				"HUI Loader",
				"Kaba",
				"Korplug",
				"LockFile",
				"Night Sky",
				"NightSky",
				"Pandora",
				"PlugX",
				"RedDelta",
				"Sogu",
				"TIGERPLUG",
				"TVT",
				"Thoper",
				"Xamtrav",
				"cobeacon"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "c69bcda3-0893-4ea1-9ec1-ae016332d283",
			"created_at": "2023-01-06T13:46:39.410593Z",
			"updated_at": "2026-04-10T02:00:03.317754Z",
			"deleted_at": null,
			"main_name": "BRONZE STARLIGHT",
			"aliases": [
				"DEV-0401",
				"Cinnamon Tempest",
				"Emperor Dragonfly",
				"SLIME34"
			],
			"source_name": "MISPGALAXY:BRONZE STARLIGHT",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "9806f226-935f-48eb-b138-6616c9bb9d69",
			"created_at": "2022-10-25T16:07:23.73153Z",
			"updated_at": "2026-04-10T02:00:04.729977Z",
			"deleted_at": null,
			"main_name": "Indrik Spider",
			"aliases": [
				"Blue Lelantos",
				"DEV-0243",
				"Evil Corp",
				"G0119",
				"Gold Drake",
				"Gold Winter",
				"Manatee Tempest",
				"Mustard Tempest",
				"UNC2165"
			],
			"source_name": "ETDA:Indrik Spider",
			"tools": [
				"Advanced Port Scanner",
				"Agentemis",
				"Babuk",
				"Babuk Locker",
				"Babyk",
				"BitPaymer",
				"Bugat",
				"Bugat v5",
				"Cobalt Strike",
				"CobaltStrike",
				"Cridex",
				"Dridex",
				"EmPyre",
				"EmpireProject",
				"FAKEUPDATES",
				"FakeUpdate",
				"Feodo",
				"FriedEx",
				"Hades",
				"IEncrypt",
				"LINK_MSIEXEC",
				"MEGAsync",
				"Macaw Locker",
				"Metasploit",
				"Mimikatz",
				"PayloadBIN",
				"Phoenix Locker",
				"PowerShell Empire",
				"PowerSploit",
				"PsExec",
				"QNAP-Worm",
				"Raspberry Robin",
				"RaspberryRobin",
				"SocGholish",
				"Vasa Locker",
				"WastedLoader",
				"WastedLocker",
				"cobeacon",
				"wp_encrypt"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "6c4f98b3-fe14-42d6-beaa-866395455e52",
			"created_at": "2023-01-06T13:46:39.169554Z",
			"updated_at": "2026-04-10T02:00:03.23458Z",
			"deleted_at": null,
			"main_name": "Evil Corp",
			"aliases": [
				"GOLD DRAKE"
			],
			"source_name": "MISPGALAXY:Evil Corp",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "84aa9dbe-e992-4dce-9d80-af3b2de058c0",
			"created_at": "2024-02-02T02:00:04.041676Z",
			"updated_at": "2026-04-10T02:00:03.537352Z",
			"deleted_at": null,
			"main_name": "Vanilla Tempest",
			"aliases": [
				"DEV-0832",
				"Vice Society"
			],
			"source_name": "MISPGALAXY:Vanilla Tempest",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "d511e74b-96b8-4ab9-88d6-bc183351dbd8",
			"created_at": "2025-08-07T02:03:24.674685Z",
			"updated_at": "2026-04-10T02:00:03.800936Z",
			"deleted_at": null,
			"main_name": "BRONZE STARLIGHT",
			"aliases": [
				"Cinnamon Tempest ",
				"DEV-0401 ",
				"Emperor Dragonfly "
			],
			"source_name": "Secureworks:BRONZE STARLIGHT",
			"tools": [
				"AtomSilo",
				"Cobalt Strike",
				"HUI Loader",
				"Impacket",
				"LockFile",
				"NightSky",
				"Pandora",
				"PlugX",
				"Rook"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "cf1c7efe-4464-4347-95d3-c86fb4d7db51",
			"created_at": "2022-10-25T16:07:24.35977Z",
			"updated_at": "2026-04-10T02:00:04.953882Z",
			"deleted_at": null,
			"main_name": "UNC2447",
			"aliases": [],
			"source_name": "ETDA:UNC2447",
			"tools": [
				"7-Zip",
				"AdFind",
				"Agentemis",
				"Cobalt Strike",
				"CobaltStrike",
				"DEATHRANSOM",
				"DeathRansom",
				"FIVEHANDS",
				"FOXGRABBER",
				"HELLOKITTY",
				"HelloKitty",
				"KittyCrypt",
				"Mimikatz",
				"PCHUNTER",
				"RCLONE",
				"ROUTERSCAN",
				"Ragnar Locker",
				"RagnarLocker",
				"Rclone",
				"S3BROWSER",
				"SombRAT",
				"Thieflock",
				"WARPRISM",
				"cobeacon",
				"deathransom",
				"wacatac"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "81e29474-63ad-4ce8-97db-b1712d5481d5",
			"created_at": "2024-04-24T02:00:49.570158Z",
			"updated_at": "2026-04-10T02:00:05.285111Z",
			"deleted_at": null,
			"main_name": "Cinnamon Tempest",
			"aliases": [
				"Cinnamon Tempest",
				"DEV-0401",
				"Emperor Dragonfly",
				"BRONZE STARLIGHT"
			],
			"source_name": "MITRE:Cinnamon Tempest",
			"tools": [
				"Pandora",
				"PlugX",
				"Cheerscrypt",
				"Impacket",
				"Cobalt Strike",
				"HUI Loader",
				"Rclone"
			],
			"source_id": "MITRE",
			"reports": null
		}
	],
	"ts_created_at": 1775439049,
	"ts_updated_at": 1775792271,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/c93fb88ea6bff50befe7d98d1381cc0b5d9ceefe.pdf",
		"text": "https://archive.orkl.eu/c93fb88ea6bff50befe7d98d1381cc0b5d9ceefe.txt",
		"img": "https://archive.orkl.eu/c93fb88ea6bff50befe7d98d1381cc0b5d9ceefe.jpg"
	}
}