General
-
Target
ed2eb398aacab149d9866f4ec09de6a0a50df147667885746517e2cefa88e611
-
Size
3.0MB
-
Sample
220510-xkbbnaadaq
-
MD5
17f95ac4e4d7558cec31bbb8c1fca3ff
-
SHA1
1e24ae99ebc5335ac82a05d5bfd97ea6028401c3
-
SHA256
ed2eb398aacab149d9866f4ec09de6a0a50df147667885746517e2cefa88e611
-
SHA512
7cd7ae945ef491ea3739e2d6f018631ef83d76f51845971f1cdf3b436c5de0893a94973ca86412bc8ea7464db456629860b97f748cd6f486067a0a2d67eb98d8
Static task
static1
Behavioral task
behavioral1
Sample
ed2eb398aacab149d9866f4ec09de6a0a50df147667885746517e2cefa88e611.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
ed2eb398aacab149d9866f4ec09de6a0a50df147667885746517e2cefa88e611.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\nsf8F47F.tmp\eula_part.1.txt
ryuk
Targets
-
-
Target
ed2eb398aacab149d9866f4ec09de6a0a50df147667885746517e2cefa88e611
-
Size
3.0MB
-
MD5
17f95ac4e4d7558cec31bbb8c1fca3ff
-
SHA1
1e24ae99ebc5335ac82a05d5bfd97ea6028401c3
-
SHA256
ed2eb398aacab149d9866f4ec09de6a0a50df147667885746517e2cefa88e611
-
SHA512
7cd7ae945ef491ea3739e2d6f018631ef83d76f51845971f1cdf3b436c5de0893a94973ca86412bc8ea7464db456629860b97f748cd6f486067a0a2d67eb98d8
Score10/10-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-