ThaiCERT    ETDA    MDES
Report
Search
Home > List all groups > List all tools > List all groups using tool RUHAPPY

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: RUHAPPY

NamesRUHAPPY
CategoryMalware
TypeWiper
Description(FireEye) RUHAPPY is a destructive wiper tool seen on systems targeted by DOGCALL. It attempts to overwrite the MBR, causing the system not to boot. When victims' systems attempt to boot, the string 'Are you Happy?' is displayed. The malware is believed to be tied to the developers of DOGCALL and HAPPYWORK based on similar PDB paths in all three.
Information<https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf>

Last change to this tool card: 23 April 2020

Download this tool card in JSON format

Previous: Rubeus
Next: Ruler

All groups using tool RUHAPPY

ChangedNameCountryObserved

APT groups

XReaper, APT 37, Ricochet Chollima, ScarCruftNorth Korea2012-Dec 2020 HOTX

1 group listed (1 APT, 0 other, 0 unknown)

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key