General
-
Target
899d401abf00b5851fcb30e0d0edbdfbfee92d98bfd9acf77577d2f19b9c25d9
-
Size
170KB
-
Sample
220220-fh746sghd6
-
MD5
240c65966ac7c6f71a2b98e951cb57cb
-
SHA1
eba0ad0aa3b10d64882425bc2f11068b51ab5251
-
SHA256
899d401abf00b5851fcb30e0d0edbdfbfee92d98bfd9acf77577d2f19b9c25d9
-
SHA512
d75fedf7a963213a39ca392dcd026d02fa289148473f1862ec38973f8604b34aa384fd538ce9741f0c32ef222eeedc63b5f138ae31f67edc9dd5f50702803c5f
Static task
static1
Behavioral task
behavioral1
Sample
899d401abf00b5851fcb30e0d0edbdfbfee92d98bfd9acf77577d2f19b9c25d9.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
899d401abf00b5851fcb30e0d0edbdfbfee92d98bfd9acf77577d2f19b9c25d9.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\RyukReadMe.txt
ryuk
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Targets
-
-
Target
899d401abf00b5851fcb30e0d0edbdfbfee92d98bfd9acf77577d2f19b9c25d9
-
Size
170KB
-
MD5
240c65966ac7c6f71a2b98e951cb57cb
-
SHA1
eba0ad0aa3b10d64882425bc2f11068b51ab5251
-
SHA256
899d401abf00b5851fcb30e0d0edbdfbfee92d98bfd9acf77577d2f19b9c25d9
-
SHA512
d75fedf7a963213a39ca392dcd026d02fa289148473f1862ec38973f8604b34aa384fd538ce9741f0c32ef222eeedc63b5f138ae31f67edc9dd5f50702803c5f
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-