General
-
Target
v4.exe
-
Size
68KB
-
Sample
210819-gzbfszpgme
-
MD5
1a95ef555a4b16768d698f263cbba1f9
-
SHA1
37d9f7ba2da8a62554573b05ca995feba698b840
-
SHA256
d869ece8bef79067afd2a221373604179ac4134a6d9be662d92f6fe9739a82b8
-
SHA512
9cf6e004f1177609a6f159be2ccc1efc16cad6c8810c6575e6c8ad742ec41ff077a0515b726dfa0babb6ea4e61829593165aa24da8c7ecf8eb22a33ef47c4154
Static task
static1
Behavioral task
behavioral1
Sample
v4.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
v4.exe
Resource
win10v20210410
Malware Config
Extracted
C:\Users\Admin\Desktop\read_it.txt
bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0
Extracted
C:\Users\Admin\Documents\TestFormat.txt
ryuk
Targets
-
-
Target
v4.exe
-
Size
68KB
-
MD5
1a95ef555a4b16768d698f263cbba1f9
-
SHA1
37d9f7ba2da8a62554573b05ca995feba698b840
-
SHA256
d869ece8bef79067afd2a221373604179ac4134a6d9be662d92f6fe9739a82b8
-
SHA512
9cf6e004f1177609a6f159be2ccc1efc16cad6c8810c6575e6c8ad742ec41ff077a0515b726dfa0babb6ea4e61829593165aa24da8c7ecf8eb22a33ef47c4154
Score10/10-
Modifies boot configuration data using bcdedit
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Drops desktop.ini file(s)
-