Extracted

• • Target

    rabid-explanation

  • Size

    205KB

  • MD5

    7971b1a36647406d5d150a12087744f5

  • SHA1

    2fb4a5b516d6a41688245d28a8030af24a2e250c

  • SHA256

    c3ccfd4dd4b5d6bcde6ce0c5eed8ee12f8a2b4a5bec4bd6d06805689f412f23f

  • SHA512

    527ea88e6c948c809eb5940c53b9f47715fdcf0f88466270e99ea35b2757a8cbde8d9a0fb4ae52c43393c1b1a3248077e14e7aefd3ebbb6103091cf18bde977d

  Score

  10^/10

  ryukransomware

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk

  • Drops file in Drivers directory

  • Modifies extensions of user files

    Ransomware generally changes the extension on encrypted files.

    ransomware

  • Drops startup file

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1