General
-
Target
180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
-
Size
635KB
-
Sample
220902-qr3k6ahab2
-
MD5
a563c50c5fa0fd541248acaf72cc4e7d
-
SHA1
4b8c12b074e20a796071aa50dc82fe2ff755e8f6
-
SHA256
180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843
-
SHA512
d7c4c92b3eeb8cefe6d007b7b4fd79cbec388582ca0f3708d520a2c3e432d490d2f69ce365edbc1141f13e71ac473fed74a4367b7898af68d5c1e3b4e4899479
-
SSDEEP
6144:LA+0uP79QAbIhsU2Hl7A6P+ZT6EnW5TMGRx4S7SM22C4:LACbIhs5He6PtgvS7SM2T4
Static task
static1
Behavioral task
behavioral1
Sample
180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
C:\users\Public\RyukReadMe.html
ryuk
http://piesa6sapybbrz63pqmmwdzyc5fp73b3uya5cpli6pp5jpswndiu44id.onion
Targets
-
-
Target
180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
-
Size
635KB
-
MD5
a563c50c5fa0fd541248acaf72cc4e7d
-
SHA1
4b8c12b074e20a796071aa50dc82fe2ff755e8f6
-
SHA256
180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843
-
SHA512
d7c4c92b3eeb8cefe6d007b7b4fd79cbec388582ca0f3708d520a2c3e432d490d2f69ce365edbc1141f13e71ac473fed74a4367b7898af68d5c1e3b4e4899479
-
SSDEEP
6144:LA+0uP79QAbIhsU2Hl7A6P+ZT6EnW5TMGRx4S7SM22C4:LACbIhs5He6PtgvS7SM2T4
Score10/10-
Dave packer
Detects executable using a packer named 'Dave' by the community, based on a string at the end.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Modifies file permissions
-
Drops desktop.ini file(s)
-