Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Back to malware
MalwareRansomware

Shanya-Killer

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

MITRE ATT&CK

Techniques & procedures

4 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique
T1574.001DLLEvidence1

Shanya-Killer ... DLLサイドローディング、AMSI bypass、anti-VM機能を含む

Privilege Escalation

1 technique
T1068Exploitation for Privilege EscalationEvidence1

BYOVD 脆弱なカーネルドライバを持ち込んで、EDRの検知機構を書き換えたり無効化したりする系。基本方には、カーネル空間のメモリを書き換えるような脆弱性を持つカーネルドライバが使用される。

Stealth

1 technique
T1574.001DLLEvidence1

Shanya-Killer ... DLLサイドローディング、AMSI bypass、anti-VM機能を含む

Defense Impairment

1 technique
T1553Subvert Trust ControlsEvidence1

脆弱な署名済みドライバを武器化し ... Process Explorer(ProcExp)ドライバ(Microsoft署名済み)を悪用

Other

1 technique
T1562.001Disable or Modify ToolsEvidence1

taskkill、net stop、sc deleteなどの組み込みの管理ツールやコマンドを悪用して、セキュリティ製品のプロセスやサービスを改ざんします。

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping4

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.