General
-
Target
1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992
-
Size
155KB
-
Sample
220220-lxrcvsccfl
-
MD5
c5609ab395ee733f889c28d9f93f2af3
-
SHA1
ee4099fc9381c45aaa32505521a8dbc1daf3ff78
-
SHA256
1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992
-
SHA512
39fa80bc077b24b1f8814b19722613b472343dded1fd14b1231e11a6b03c2ae477db2f787a4f2d72b39b611c2070ad833068e2e01fd18e9cab257414e2ce1caf
Static task
static1
Behavioral task
behavioral1
Sample
1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\RyukReadMe.txt
ryuk
1CN2iQbBikFK9jM34Nb3WLx5DCenQLnbXp
Targets
-
-
Target
1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992
-
Size
155KB
-
MD5
c5609ab395ee733f889c28d9f93f2af3
-
SHA1
ee4099fc9381c45aaa32505521a8dbc1daf3ff78
-
SHA256
1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992
-
SHA512
39fa80bc077b24b1f8814b19722613b472343dded1fd14b1231e11a6b03c2ae477db2f787a4f2d72b39b611c2070ad833068e2e01fd18e9cab257414e2ce1caf
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-