General
-
Target
c12ea811bbe3c730529545f379aa852ed85c6ae5d45307dd45cc13ca0cd6ccd0
-
Size
315KB
-
Sample
220220-cyewsafge9
-
MD5
9412504a6d0ba4a5526c42b032ae51de
-
SHA1
3cc1f29877ed739f0fee3250b2cbc648f9f014f1
-
SHA256
c12ea811bbe3c730529545f379aa852ed85c6ae5d45307dd45cc13ca0cd6ccd0
-
SHA512
52f77c8c4e8308afd4ed928e2c94c44594ad9185b8a8ede24c7185f8ba4d225ac58f5c3cf80a228c1cd2b78df7910c296eefdac4e623cf4d0116d9c2df647a71
Static task
static1
Behavioral task
behavioral1
Sample
c12ea811bbe3c730529545f379aa852ed85c6ae5d45307dd45cc13ca0cd6ccd0.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
c12ea811bbe3c730529545f379aa852ed85c6ae5d45307dd45cc13ca0cd6ccd0.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\RyukReadMe.txt
ryuk
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Targets
-
-
Target
c12ea811bbe3c730529545f379aa852ed85c6ae5d45307dd45cc13ca0cd6ccd0
-
Size
315KB
-
MD5
9412504a6d0ba4a5526c42b032ae51de
-
SHA1
3cc1f29877ed739f0fee3250b2cbc648f9f014f1
-
SHA256
c12ea811bbe3c730529545f379aa852ed85c6ae5d45307dd45cc13ca0cd6ccd0
-
SHA512
52f77c8c4e8308afd4ed928e2c94c44594ad9185b8a8ede24c7185f8ba4d225ac58f5c3cf80a228c1cd2b78df7910c296eefdac4e623cf4d0116d9c2df647a71
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-