General
-
Target
8ce02ae8466375b1e5ee47e6b8c4e0b5f3dbb1b0493ba7012b3662b00cbfb736
-
Size
136KB
-
Sample
220220-fdlqdahhal
-
MD5
61f3e072c19f758359d18d5e8f757630
-
SHA1
40665226308f95a4e297ccd1bc63e2b6e1337d6b
-
SHA256
8ce02ae8466375b1e5ee47e6b8c4e0b5f3dbb1b0493ba7012b3662b00cbfb736
-
SHA512
2302205f21afe80a4fd2027acb5faebf18ca6b5cc0f59581e6664877ca886ef4b0d3112aeefa6f76c7876c4db9536dd57a221ba80376b4b201e7729a5d639d6c
Static task
static1
Behavioral task
behavioral1
Sample
8ce02ae8466375b1e5ee47e6b8c4e0b5f3dbb1b0493ba7012b3662b00cbfb736.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
8ce02ae8466375b1e5ee47e6b8c4e0b5f3dbb1b0493ba7012b3662b00cbfb736.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\RyukReadMe.txt
ryuk
1NQ42zc51stA4WAVkUK8uqFAjo1DbWv4Kz
Targets
-
-
Target
8ce02ae8466375b1e5ee47e6b8c4e0b5f3dbb1b0493ba7012b3662b00cbfb736
-
Size
136KB
-
MD5
61f3e072c19f758359d18d5e8f757630
-
SHA1
40665226308f95a4e297ccd1bc63e2b6e1337d6b
-
SHA256
8ce02ae8466375b1e5ee47e6b8c4e0b5f3dbb1b0493ba7012b3662b00cbfb736
-
SHA512
2302205f21afe80a4fd2027acb5faebf18ca6b5cc0f59581e6664877ca886ef4b0d3112aeefa6f76c7876c4db9536dd57a221ba80376b4b201e7729a5d639d6c
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-