Overview

overview

8

Static

static

3

2024-04-25...uk.exe

windows7-x64

8

2024-04-25...uk.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-04-25_fa244f8a1d84b14e4132d691728175ce_ryuk

  • Size

    49.8MB

  • Sample

    240425-kxl8gahc68

  • MD5

    fa244f8a1d84b14e4132d691728175ce

  • SHA1

    0c4ef9d94256f5aefce8fa98a6be4c90e94ab39d

  • SHA256

    d008cfe6779cfd35d334a958ca613b8243529c5706cc06b598d589944b424b24

  • SHA512

    286b10d839c399ac7620a3e7f07594310d5d15d87af242958328fb564c820431d2e9d5f75e663c83dacedc952d4674d0c9d53a60433a1f2f329627e7c8f1bb1e

  • SSDEEP

    1572864:5skm68CYgwt2TGD3bs7vMjobyuQHJi0n:5M6mt2TaLsMsCpia

Score
8/10
evasionpyinstaller

Malware Config

Targets

    • Target

      2024-04-25_fa244f8a1d84b14e4132d691728175ce_ryuk

    • Size

      49.8MB

    • MD5

      fa244f8a1d84b14e4132d691728175ce

    • SHA1

      0c4ef9d94256f5aefce8fa98a6be4c90e94ab39d

    • SHA256

      d008cfe6779cfd35d334a958ca613b8243529c5706cc06b598d589944b424b24

    • SHA512

      286b10d839c399ac7620a3e7f07594310d5d15d87af242958328fb564c820431d2e9d5f75e663c83dacedc952d4674d0c9d53a60433a1f2f329627e7c8f1bb1e

    • SSDEEP

      1572864:5skm68CYgwt2TGD3bs7vMjobyuQHJi0n:5M6mt2TaLsMsCpia

    Score
    8/10
    evasion

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks