Extracted

• • Target

    a0dccbe010859116063fc3f7e00c8c7bd68b849eeb7238a10b1b9f07f5c36510

  • Size

    171KB

  • MD5

    567407d941d99abeff20a1b836570d30

  • SHA1

    e8866fda01f91c6d4bf8c51cf4cbc7f103e87b0b

  • SHA256

    a0dccbe010859116063fc3f7e00c8c7bd68b849eeb7238a10b1b9f07f5c36510

  • SHA512

    514cc28f8da0e8bf054bf0a0963c4253a16df1d5cb8e87dd09294ab97d8e1b5b5fc18c54920a3829d40b0bdda5837567a73b39b4d1839ab919d672ceaf32989b

  Score

  10^/10

  ryukpersistenceransomwarespywarestealer

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Modifies extensions of user files

    Ransomware generally changes the extension on encrypted files.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2