General
-
Target
3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc
-
Size
140KB
-
Sample
220220-j2ztpabdhk
-
MD5
d27a71b6b5bb69501ac88ab920878446
-
SHA1
0d06f9eb99239d6637936dd0637e17ea537f55cf
-
SHA256
3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc
-
SHA512
037f7b34841dd924574089bede0acfc8ae374a612cc4151180a7aee684581b1896562956e950c0aed27355062ad27318557f8091fcf1afe7440544094fb58810
Static task
static1
Behavioral task
behavioral1
Sample
3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\RyukReadMe.txt
ryuk
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Targets
-
-
Target
3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc
-
Size
140KB
-
MD5
d27a71b6b5bb69501ac88ab920878446
-
SHA1
0d06f9eb99239d6637936dd0637e17ea537f55cf
-
SHA256
3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc
-
SHA512
037f7b34841dd924574089bede0acfc8ae374a612cc4151180a7aee684581b1896562956e950c0aed27355062ad27318557f8091fcf1afe7440544094fb58810
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-