Overview

overview

10

Static

static

05e0670952...1f.exe

windows7_x64

10

05e0670952...1f.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05e06709523fd798da963c2c24254de0fcca6c57e1052996798ecc74ff43b41f

  • Size

    304KB

  • Sample

    210219-23lwqc9qnx

  • MD5

    19fb1b610cb224e9441f962d04e263f2

  • SHA1

    afd8e08baeff92d8f473bcfbdbc1c13d89e971ae

  • SHA256

    05e06709523fd798da963c2c24254de0fcca6c57e1052996798ecc74ff43b41f

  • SHA512

    6a5a32a0638922fdcea6dc4af508f40bb06a7c4abcf482af1dff94d604c1f4e8df56b16c03574c9b4da9cdb5dcb6365bd1b9cfa6b543805cb5d3a07511b176e8

Score
10/10
ryukdiscoveryransomware

Malware Config

Targets

    • Target

      05e06709523fd798da963c2c24254de0fcca6c57e1052996798ecc74ff43b41f

    • Size

      304KB

    • MD5

      19fb1b610cb224e9441f962d04e263f2

    • SHA1

      afd8e08baeff92d8f473bcfbdbc1c13d89e971ae

    • SHA256

      05e06709523fd798da963c2c24254de0fcca6c57e1052996798ecc74ff43b41f

    • SHA512

      6a5a32a0638922fdcea6dc4af508f40bb06a7c4abcf482af1dff94d604c1f4e8df56b16c03574c9b4da9cdb5dcb6365bd1b9cfa6b543805cb5d3a07511b176e8

    Score
    10/10
    ryukdiscoveryransomware

    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

      ransomwareryuk

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks