General
-
Target
414bfb0bb83ad01da8f54cb858aae7ee37b6029cf529d6e6f89ee0f451edbd87
-
Size
170KB
-
Sample
220220-jybyfsbddq
-
MD5
d4089e8c00e1346099de330df50b027a
-
SHA1
c7726ace55949d59d845130313c17687407e5367
-
SHA256
414bfb0bb83ad01da8f54cb858aae7ee37b6029cf529d6e6f89ee0f451edbd87
-
SHA512
ad61c25e90acccf86dde8f99b496c3d857b235d143a5251b81e23e424e83bcabe89671e0c58fae0bbccba1f6640bd9f4decd6195b718da9399179745b93540c4
Static task
static1
Behavioral task
behavioral1
Sample
414bfb0bb83ad01da8f54cb858aae7ee37b6029cf529d6e6f89ee0f451edbd87.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
414bfb0bb83ad01da8f54cb858aae7ee37b6029cf529d6e6f89ee0f451edbd87.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\RyukReadMe.txt
ryuk
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Targets
-
-
Target
414bfb0bb83ad01da8f54cb858aae7ee37b6029cf529d6e6f89ee0f451edbd87
-
Size
170KB
-
MD5
d4089e8c00e1346099de330df50b027a
-
SHA1
c7726ace55949d59d845130313c17687407e5367
-
SHA256
414bfb0bb83ad01da8f54cb858aae7ee37b6029cf529d6e6f89ee0f451edbd87
-
SHA512
ad61c25e90acccf86dde8f99b496c3d857b235d143a5251b81e23e424e83bcabe89671e0c58fae0bbccba1f6640bd9f4decd6195b718da9399179745b93540c4
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-