Extracted

• • Target

    2024-04-15_4e1d1fc6c276c6df5a69012b2e7b72ea_ryuk

  • Size

    354KB

  • MD5

    4e1d1fc6c276c6df5a69012b2e7b72ea

  • SHA1

    9f20916ca1b4d0f962ffc4bf95fafb38a0c06b68

  • SHA256

    6c00f372f51e691714fedf0418e9fbeb99f07f1e39bf340941ef59a24fe834cd

  • SHA512

    8841188a7dd6ec556333a92c8f394c7b377433183486043c16baf0ec2246056a8f1b684539553896e0de633c2c2b73f077a9a7e0d8f7428d56f79f855ab37322

  • SSDEEP

    6144:P1AtjM+EVs7+W7d2lw4GAcstxxIHohqJpyQysE:t+M+FdCGAfUo0aQysE

  Score

  10^/10

  phorphiexevasionloaderpersistencespywarestealertrojanworm

  • Modifies security service

    evasion

  • Phorphiex

    Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Windows security bypass

    evasiontrojan

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2