General
-
Target
0280ccc8d6dbb14d79adf375fa386a534cd74b40c684ed47db0d2e4f659e4da4
-
Size
170KB
-
Sample
220219-ksyeyaaag4
-
MD5
b9d73fa0261bb6adaa2cb22f348518f0
-
SHA1
d52e7a4cb8ccad688572a8e5d38b43a0e38e3bc3
-
SHA256
0280ccc8d6dbb14d79adf375fa386a534cd74b40c684ed47db0d2e4f659e4da4
-
SHA512
58e3f79e6de19df40b0992aa108e4022979e1c7b2be26e3dced26261c6ea800b89f1c00ac6e67340b4092cf3ada4a6c22c2aeb69eddba7838339a8c4e3799ff4
Static task
static1
Behavioral task
behavioral1
Sample
0280ccc8d6dbb14d79adf375fa386a534cd74b40c684ed47db0d2e4f659e4da4.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
0280ccc8d6dbb14d79adf375fa386a534cd74b40c684ed47db0d2e4f659e4da4.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\RyukReadMe.txt
ryuk
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Targets
-
-
Target
0280ccc8d6dbb14d79adf375fa386a534cd74b40c684ed47db0d2e4f659e4da4
-
Size
170KB
-
MD5
b9d73fa0261bb6adaa2cb22f348518f0
-
SHA1
d52e7a4cb8ccad688572a8e5d38b43a0e38e3bc3
-
SHA256
0280ccc8d6dbb14d79adf375fa386a534cd74b40c684ed47db0d2e4f659e4da4
-
SHA512
58e3f79e6de19df40b0992aa108e4022979e1c7b2be26e3dced26261c6ea800b89f1c00ac6e67340b4092cf3ada4a6c22c2aeb69eddba7838339a8c4e3799ff4
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-