General
-
Target
310da667cf387ecfe5d24730104fefbd3f9478c786db59c8ee7a39c1265e8af0
-
Size
170KB
-
Sample
220220-kng76abgbn
-
MD5
af1f77eedf16f8a00fa500e0f8dbedbe
-
SHA1
67b3d0c7013a9ccee08e948a82dde6d0e8b01828
-
SHA256
310da667cf387ecfe5d24730104fefbd3f9478c786db59c8ee7a39c1265e8af0
-
SHA512
0fcf486b2acaa0c71e123871cac423feb14c100c6c81d76a3b5ebbe6014d230749e109c583f62ea0287c29b810d957d7544b5b9761f0fa1408e4e775307e5aeb
Static task
static1
Behavioral task
behavioral1
Sample
310da667cf387ecfe5d24730104fefbd3f9478c786db59c8ee7a39c1265e8af0.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
310da667cf387ecfe5d24730104fefbd3f9478c786db59c8ee7a39c1265e8af0.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\RyukReadMe.txt
ryuk
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Targets
-
-
Target
310da667cf387ecfe5d24730104fefbd3f9478c786db59c8ee7a39c1265e8af0
-
Size
170KB
-
MD5
af1f77eedf16f8a00fa500e0f8dbedbe
-
SHA1
67b3d0c7013a9ccee08e948a82dde6d0e8b01828
-
SHA256
310da667cf387ecfe5d24730104fefbd3f9478c786db59c8ee7a39c1265e8af0
-
SHA512
0fcf486b2acaa0c71e123871cac423feb14c100c6c81d76a3b5ebbe6014d230749e109c583f62ea0287c29b810d957d7544b5b9761f0fa1408e4e775307e5aeb
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-