T1486 Data Encrypted for Impact in real malware
ATT&CK technique T1486 Data Encrypted for Impact appears in 157 publicly analyzed samples on MalwareAnalyzer by Cyble, 0.2% of the analyzed corpus. Seven-day prevalence is rising (45 recent vs 35 prior). Most associated families: Ulise, HUILoader, Wanna.
Tactics: impact
Prevalence in the corpus
- Samples exhibiting T1486: 157
- Share of analyzed corpus: 0.2%
- Last 7 days: 45 · prior 7 days: 35 (rising)
Malware families using T1486
Example samples
- 5599812c846bf630def0c094526678ea0be08a4ece8811fa3470195b461d248e - malicious
- 8f7534bc35eef77421f8a2ba8ef6acea78f0adcb64c43db505b52f0e450adc76 - malicious
- 040fbc941865d1f2fcae8f51a4848f35daea29ea881611af3f7b55f6887cdfd5 - malicious
- c0f8204deafadd188e82e1c623be52f70a5bad0b544c3cd257d229b8c06a5bf2 - malicious
- 781edaa2d0e49cbb5efbae30b1a67c3093730d255f96664f73729e2a7921e939 - malicious
- e59da8f9150f12c7277d98b60641d2ff110a144ea10a34d5c8dca71aa4c655c6 - malicious
- 63935268c3fd6806fc5de779b5f72358721f7dd537de53f019f3baa1cbdb3451 - malicious
- ae89298892c699784513f46606072f632d1c0383a06f5702a86e8583f7045392 - malicious
- Aurora15Connector.exe - malicious
- 5605466b4f874f47e5c996b56caef44ab7baa253b7f4ca1a221806bbf7c34580 - malicious
- 0e61e8e6d4118a5b4a3a11fdf887fd2f504be8468c56dd5601c5d41fb5e845eb - malicious
- dc17571c5a9ee51c03be555e38d40448461cf17e967230ad8abb4f7325ae4f7c - malicious
- dbe6eb8fa069c3edcea4a87b1193539b111da5c8c918e49ffe78a240a722682a - malicious
- 97f03565f485af62998dfaa5283f8f61118c3a6315cb3112a2bd0f41c1f07222 - malicious
- 650fea17d9b35bac50bffb51e47882dd28c5ea9db30211fdb9f87abd4462c0d2 - malicious
- cfd7fdc9447d994abd14313bcd934d5a1bf9c1f8cef57a0e7887c9db48a26ee0 - malicious
- 035a6fa4064026934d0a631c9c1f1b9a5225b407c212bb99049d18b995b8e8a4 - malicious
- virussign.com_da3749f1954d79d4e171c2ae97a544b0.vir - malicious
- virussign.com_c96e0c267b2e4ff3500499f612f063b0.vir - malicious
- e3c31a2c2367ddf0a502d7b5da3782b9f49cebb7ac7979b12fbcef027442674e - malicious
- 77a7cb77afda1556b45835d3625b39752ec28c09c77634afe517dcc7a9c41e44 - malicious
- 9da96254d9347a5da6e5fd1c6a14d5049c19d6f1564d8c49573b05253f96340b - malicious
- Aurora15Connector.exe - malicious
- d1b228b1c037e1f925d43a81bc8a086d098434255482beeba7f83b2a93bf4315 - malicious
- 34f5b7085f70c84cc864277e7a3dcdc8e6c8ffe327d70a059c57ea68f09854e3 - malicious
Canonical technique definition: MITRE ATT&CK T1486 (ATT&CK v19.1, CC BY 4.0).
Frequently asked about T1486
- How common is ATT&CK T1486 (Data Encrypted for Impact) in real malware?
- ATT&CK technique T1486 Data Encrypted for Impact appears in 157 publicly analyzed samples on MalwareAnalyzer by Cyble, 0.2% of the analyzed corpus. Seven-day prevalence is rising (45 recent vs 35 prior). Most associated families: Ulise, HUILoader, Wanna.
- Is T1486 becoming more common?
- Prevalence is rising: 45 samples in the last seven days against 35 in the seven days before. This measures submissions to MalwareAnalyzer by Cyble, so it reflects what is being submitted here rather than global attacker behaviour.
- Which malware families use T1486?
- In this corpus T1486 is most associated with Ulise (14), HUILoader (9), Wanna (9). Counts are analyzed samples per family in which the technique was observed.
- What share of analyzed samples use T1486?
- 0.2% of the publicly analyzed corpus (157 of 100981 samples) exhibits T1486. Technique attribution comes from behavior captured during real sandbox detonation and from static analysis, not from a vendor label.
All ATT&CK techniques in the corpus · Latest analyzed threats