Extracted

• • Target

    92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed

  • Size

    353KB

  • MD5

    1737388ce8b0b5fc2dbc22f5b7352b7c

  • SHA1

    e62135254b3a51f0180e70a11e4c3ad4a59f81c4

  • SHA256

    92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed

  • SHA512

    e47d6fe5049e3019dfb1161bfaf7038171dad39c657200c115cbc26f2be46ead92319e20e5e77e0e91ad93d17562090dda75efc5fb5fb22bef1d47df2aef657b

  Score

  10^/10

  ryukdiscoveryransomware

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk

  • Modifies file permissions

    discovery

  • Drops desktop.ini file(s)

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2