Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2024-05-01_8e2e689ff61cf9a422d2800338098a3e_ryuk
-
Size
8.5MB
-
Sample
240501-bbq5vsdg75
-
MD5
8e2e689ff61cf9a422d2800338098a3e
-
SHA1
c871e4ca5e20d496cb69ab6d2df07be0592b6584
-
SHA256
fcefde2ed490119c73ac4f89752e4c8225c66dd06e1fd3db2d7a1dd207e30613
-
SHA512
47f9cc182f619c23b86ef60b24da831cd5373a81e8c3016cd97c71e667d3ad02763002c091c62b74988258588aa552af4cc586592c70ba10015c5dc461dd039a
-
SSDEEP
98304:lj21qjo/OmhIVE0HeIOq/y6SCmtC8RHemKSPM7D/ClKlwvfW2T2ixwf:lq1q8/OmhIVBlOM5mtCgKSlKgfW8xw
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-01_8e2e689ff61cf9a422d2800338098a3e_ryuk.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-05-01_8e2e689ff61cf9a422d2800338098a3e_ryuk.exe
Resource
win10v2004-20240419-en
Malware Config
Targets
-
-
Target
2024-05-01_8e2e689ff61cf9a422d2800338098a3e_ryuk
-
Size
8.5MB
-
MD5
8e2e689ff61cf9a422d2800338098a3e
-
SHA1
c871e4ca5e20d496cb69ab6d2df07be0592b6584
-
SHA256
fcefde2ed490119c73ac4f89752e4c8225c66dd06e1fd3db2d7a1dd207e30613
-
SHA512
47f9cc182f619c23b86ef60b24da831cd5373a81e8c3016cd97c71e667d3ad02763002c091c62b74988258588aa552af4cc586592c70ba10015c5dc461dd039a
-
SSDEEP
98304:lj21qjo/OmhIVE0HeIOq/y6SCmtC8RHemKSPM7D/ClKlwvfW2T2ixwf:lq1q8/OmhIVBlOM5mtCgKSlKgfW8xw
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-