General
-
Target
53e5bfb0be32202aaeff40f267454abdd12e58e50d295988ad111718ad886a74
-
Size
170KB
-
Sample
220220-h5rf2saab5
-
MD5
cbc4a644b35edb3610d76068a9bd5592
-
SHA1
91e6feadc8900505902c626737d6a98f6244cfd6
-
SHA256
53e5bfb0be32202aaeff40f267454abdd12e58e50d295988ad111718ad886a74
-
SHA512
85ad10e59645d50728bb9145553fa87c6e105a8555aba0d20b349223099109c4d3d4dde56c2cee2d71e5208372dae7db96b0dd4cb12389e767f132305ba85291
Static task
static1
Behavioral task
behavioral1
Sample
53e5bfb0be32202aaeff40f267454abdd12e58e50d295988ad111718ad886a74.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
53e5bfb0be32202aaeff40f267454abdd12e58e50d295988ad111718ad886a74.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\RyukReadMe.txt
ryuk
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Targets
-
-
Target
53e5bfb0be32202aaeff40f267454abdd12e58e50d295988ad111718ad886a74
-
Size
170KB
-
MD5
cbc4a644b35edb3610d76068a9bd5592
-
SHA1
91e6feadc8900505902c626737d6a98f6244cfd6
-
SHA256
53e5bfb0be32202aaeff40f267454abdd12e58e50d295988ad111718ad886a74
-
SHA512
85ad10e59645d50728bb9145553fa87c6e105a8555aba0d20b349223099109c4d3d4dde56c2cee2d71e5208372dae7db96b0dd4cb12389e767f132305ba85291
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-