General
-
Target
d7953e6c5c6cca21de1b6db5639e70582ead7f02d4e5b3546d2ff285e283b50e
-
Size
170KB
-
Sample
220220-cd3r4sgedn
-
MD5
69693141762821147d2e79b9d4c76354
-
SHA1
ffe7d03662ebe8ff71f96f3f5994e17ca8129b9b
-
SHA256
d7953e6c5c6cca21de1b6db5639e70582ead7f02d4e5b3546d2ff285e283b50e
-
SHA512
503b604ffa13d67265513db6bef6b7e263bd10969a6002e5838798fa4ace12ce1963ddc0844412e252b5346d06b05ba48b70e52cc9aa580379d70a2e3517beff
Static task
static1
Behavioral task
behavioral1
Sample
d7953e6c5c6cca21de1b6db5639e70582ead7f02d4e5b3546d2ff285e283b50e.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
d7953e6c5c6cca21de1b6db5639e70582ead7f02d4e5b3546d2ff285e283b50e.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\RyukReadMe.txt
ryuk
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Targets
-
-
Target
d7953e6c5c6cca21de1b6db5639e70582ead7f02d4e5b3546d2ff285e283b50e
-
Size
170KB
-
MD5
69693141762821147d2e79b9d4c76354
-
SHA1
ffe7d03662ebe8ff71f96f3f5994e17ca8129b9b
-
SHA256
d7953e6c5c6cca21de1b6db5639e70582ead7f02d4e5b3546d2ff285e283b50e
-
SHA512
503b604ffa13d67265513db6bef6b7e263bd10969a6002e5838798fa4ace12ce1963ddc0844412e252b5346d06b05ba48b70e52cc9aa580379d70a2e3517beff
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-