RobbinHood - S0400 (0a607c53-df52-45da-a75d-0e53df4dad5f)

RobbinHood is ransomware that was first observed being used in an attack against the Baltimore city government's computer network.(Citation: CarbonBlack RobbinHood May 2019)(Citation: BaltimoreSun RobbinHood May 2019)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
RobbinHood - S0400 (0a607c53-df52-45da-a75d-0e53df4dad5f)	Malware	Windows Command Shell - T1059.003 (d1fcf083-a721-4223-aedf-bf8960798d62)	Attack Pattern	1
Inhibit System Recovery - T1490 (f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a)	Attack Pattern	RobbinHood - S0400 (0a607c53-df52-45da-a75d-0e53df4dad5f)	Malware	1
RobbinHood - S0400 (0a607c53-df52-45da-a75d-0e53df4dad5f)	Malware	Network Share Connection Removal - T1070.005 (a750a9f6-0bde-4bb3-9aae-1e2786e9780c)	Attack Pattern	1
Disable or Modify Tools - T1685 (bbde9781-60aa-4b8a-a911-895b0c1b3872)	Attack Pattern	RobbinHood - S0400 (0a607c53-df52-45da-a75d-0e53df4dad5f)	Malware	1
Service Stop - T1489 (20fb2507-d71c-455d-9b6d-6104461cf26b)	Attack Pattern	RobbinHood - S0400 (0a607c53-df52-45da-a75d-0e53df4dad5f)	Malware	1
Data Encrypted for Impact - T1486 (b80d107d-fa0d-4b60-9684-b0433e8bdba0)	Attack Pattern	RobbinHood - S0400 (0a607c53-df52-45da-a75d-0e53df4dad5f)	Malware	1
Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830)	Attack Pattern	Windows Command Shell - T1059.003 (d1fcf083-a721-4223-aedf-bf8960798d62)	Attack Pattern	2
Indicator Removal - T1070 (799ace7f-e227-4411-baa0-8868704f2a69)	Attack Pattern	Network Share Connection Removal - T1070.005 (a750a9f6-0bde-4bb3-9aae-1e2786e9780c)	Attack Pattern	2