Extracted

• • Target

    tmp

  • Size

    190KB

  • MD5

    5661aec52fcc80ccd4c5d263e113c115

  • SHA1

    b09fb5cfbfbadd6afdd536aa89ccab405ef8c5b2

  • SHA256

    6cbc05acf871c106f7804069fffef908472a31ea1a782add45a100d14c8f5ea0

  • SHA512

    15e2a11d1d0b614cc1181a787a3208d011447ce68f6be93df227bc1b1b95400151251cf0bf9013900876b1d8e9c93b05ab0af0f1112b2e50176879a94a19d30a

  • SSDEEP

    3072:wbYRYDEnRuxvB5oveeGiKhvFB1JWxEc2C+mZbD+o4Xd/x+j8TYQWuni/qpe:fYDcsTFbF75xCxk/dTB9pe

  Score

  10^/10

  ryukransomware

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk

  • Renames multiple (5211) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2