General
-
Target
9eb7abf2228ad28d8b7f571e0495d4a35da40607f04355307077975e271553b8.exe
-
Size
119KB
-
Sample
220901-3q9djadaak
-
MD5
c68395e474088d5339972e2bf5a30f3c
-
SHA1
502e42240969399c09337ecc7b5ca8fc1ba4baf3
-
SHA256
9eb7abf2228ad28d8b7f571e0495d4a35da40607f04355307077975e271553b8
-
SHA512
5320fe8144071dde940ebd0285e6fcf573d36c28ea51fca3b5aecc49bfe5ffcf25d1afbd294e0d0b565a3a621d5ea189b075d868bbef521f2e1fe6702e8be75a
-
SSDEEP
1536:j/t3fhrg5rw0lQa2+T37us7RidSkPq9IiJ/EXrAyPca7m94nqHBmQSsWZcdH2kB/:lG55XP0Vq9IiKXrxkKNqHBmEHNVKA
Static task
static1
Behavioral task
behavioral1
Sample
9eb7abf2228ad28d8b7f571e0495d4a35da40607f04355307077975e271553b8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9eb7abf2228ad28d8b7f571e0495d4a35da40607f04355307077975e271553b8.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\users\Public\RyukReadMe.html
ryuk
http://oc6mkf4efqrjp2ue6qp6vmz4ofyjmlo6dtqiklqb2q546bnqeu66tbyd.onion
Targets
-
-
Target
9eb7abf2228ad28d8b7f571e0495d4a35da40607f04355307077975e271553b8.exe
-
Size
119KB
-
MD5
c68395e474088d5339972e2bf5a30f3c
-
SHA1
502e42240969399c09337ecc7b5ca8fc1ba4baf3
-
SHA256
9eb7abf2228ad28d8b7f571e0495d4a35da40607f04355307077975e271553b8
-
SHA512
5320fe8144071dde940ebd0285e6fcf573d36c28ea51fca3b5aecc49bfe5ffcf25d1afbd294e0d0b565a3a621d5ea189b075d868bbef521f2e1fe6702e8be75a
-
SSDEEP
1536:j/t3fhrg5rw0lQa2+T37us7RidSkPq9IiJ/EXrAyPca7m94nqHBmQSsWZcdH2kB/:lG55XP0Vq9IiKXrxkKNqHBmEHNVKA
Score10/10-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Modifies file permissions
-
Drops desktop.ini file(s)
-