Threat video1:00
Diavol RSA Ransomware (Wizard Spider): Detection & IOCs
Diavol encrypts files partially with RSA and appends .lock64. First reported in 2021, it comes with 9 detection rules, 14 IOCs and a free Splunk SPL rule.
Read the full threat intel for Diavol RSA Ransomware (Wizard Spider): Detection & IOCs →
Chapters
- 0:00The hookFourteen routines power DIAVOL, Wizard Spider ransomware.
- 0:04The storyFortinet disclosed it July 2021.
- 0:10Attack pathLoads code from resources, registers bot ID with C2.
- 0:26AttributionAttributed to Periwinkle Tempest.
- 0:31Indicators of compromise10 indicators to hunt: 2 IPs, 2 URLs and 1 SHA-256 hash, and more.
- 0:39MITRE ATT&CK techniques15 ATT&CK techniques, from execution to impact.
- 0:44Remediation10 remediation steps are listed, 4 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Fourteen routines power DIAVOL, Wizard Spider ransomware.
0:05Fortinet disclosed it July 2021.
0:07FBI linked it to Wizard Spider.
0:11Loads code from resources, registers bot ID with C2.
0:15Disables services, deletes shadow copies.
0:18Then encrypts files with RSA, default 10%.
0:22Drops ransom note, appends .lock64.
0:27Attributed to Periwinkle Tempest. Confidence: medium.
0:3110 indicators to hunt: 2 IPs, 2 URLs and 1 SHA-256 hash, and more.
0:4015 ATT&CK techniques, from execution to impact.
0:4410 remediation steps are listed, 4 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.