General
-
Target
bPQDRgviZlan.exe
-
Size
136KB
-
Sample
210410-qkn4by636n
-
MD5
45295780f2ba837be42ccf50710bd2b5
-
SHA1
f937b1b7b3593a38702f870077658a891974edda
-
SHA256
60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025
-
SHA512
588666aa108f01334c2e0adc03aa68d5e3ebb68ee773939b668a5a6ca1eacf03570b7608d4ca3c936dd7f7ec6edd4063a05b1cef7d446661c8f00f8520e72f8b
Static task
static1
Behavioral task
behavioral1
Sample
bPQDRgviZlan.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
bPQDRgviZlan.exe
Resource
win10v20201028
Malware Config
Extracted
C:\$Recycle.Bin\RyukReadMe.html
ryuk
http://smtpys6pvcvdvram6xucwecfv7rdhs6fmxzivrbcrncdeiphryhb75id.onion
Targets
-
-
Target
bPQDRgviZlan.exe
-
Size
136KB
-
MD5
45295780f2ba837be42ccf50710bd2b5
-
SHA1
f937b1b7b3593a38702f870077658a891974edda
-
SHA256
60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025
-
SHA512
588666aa108f01334c2e0adc03aa68d5e3ebb68ee773939b668a5a6ca1eacf03570b7608d4ca3c936dd7f7ec6edd4063a05b1cef7d446661c8f00f8520e72f8b
Score10/10-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-