Extracted

• • Target

    b3846bc61ca63d9c10d6f559688e366061ae98fcbe82076b9e557b0beec6f327

  • Size

    115KB

  • MD5

    d736f4a3fc844b4a7e970b562fbeac85

  • SHA1

    fdd13c9b9e6c0e07f1215780c4ab742627e57917

  • SHA256

    b3846bc61ca63d9c10d6f559688e366061ae98fcbe82076b9e557b0beec6f327

  • SHA512

    7ee0ba7a2df6cc294b9955279bbfbfe7f3e167dc208b7d9290ba67bb0c516b228d1b75c7eeebcdb9090b85e8267d239889c3ad12718a281978a1aa00ad8509fe

  Score

  10^/10

  ryukdiscoverypersistenceransomware

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Modifies extensions of user files

    Ransomware generally changes the extension on encrypted files.

    ransomware

  • Drops startup file

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2