General
-
Target
30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781
-
Size
170KB
-
Sample
220220-knp8rsafd3
-
MD5
dd72a10cf4ee779c179d23ed6f4fdb01
-
SHA1
adc7691b97f34a9d55a3f7ca8a60e1c8756e3631
-
SHA256
30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781
-
SHA512
e63d0a3a3bad2a0899d2e815ef2bf13b2e9c7fa5fcf79194b58438120d8096d894905c63ca4eeb1ebe0d47a6b1b5a085d0936445a8a00e34e07f22b494d4c41e
Static task
static1
Behavioral task
behavioral1
Sample
30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\RyukReadMe.txt
ryuk
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Targets
-
-
Target
30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781
-
Size
170KB
-
MD5
dd72a10cf4ee779c179d23ed6f4fdb01
-
SHA1
adc7691b97f34a9d55a3f7ca8a60e1c8756e3631
-
SHA256
30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781
-
SHA512
e63d0a3a3bad2a0899d2e815ef2bf13b2e9c7fa5fcf79194b58438120d8096d894905c63ca4eeb1ebe0d47a6b1b5a085d0936445a8a00e34e07f22b494d4c41e
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-