Skip to content

Hide Navigation Hide TOC

Moneybird - S1137 (47ab6350-054f-4754-ba4d-e52a4e8751e2)

Moneybird is a ransomware variant written in C++ associated with Agrius operations. The name "Moneybird" is contained in the malware's ransom note and as strings in the executable.(Citation: CheckPoint Agrius 2023)

Cluster A Galaxy A Cluster B Galaxy B Level
Embedded Payloads - T1027.009 (0533ab23-3f7d-463f-9bd8-634d27e4dee1) Attack Pattern Moneybird - S1137 (47ab6350-054f-4754-ba4d-e52a4e8751e2) Malware 1
Data Encrypted for Impact - T1486 (b80d107d-fa0d-4b60-9684-b0433e8bdba0) Attack Pattern Moneybird - S1137 (47ab6350-054f-4754-ba4d-e52a4e8751e2) Malware 1
Embedded Payloads - T1027.009 (0533ab23-3f7d-463f-9bd8-634d27e4dee1) Attack Pattern Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a) Attack Pattern 2