Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
08-05-2024 00:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-08_319932acdfa88b9d39ba38053573e91e_ryuk.exe
Resource
win7-20231129-en
3 signatures
150 seconds
General
-
Target
2024-05-08_319932acdfa88b9d39ba38053573e91e_ryuk.exe
-
Size
1.4MB
-
MD5
319932acdfa88b9d39ba38053573e91e
-
SHA1
1e99a1538474869c87de63ca02dba1becb3fdfde
-
SHA256
e09d28db45c2267173ed54bb62b237317a8e76c01fcaa1835a960b8f7a5d5a62
-
SHA512
a71d270c85981430a9637f0ccc9ef3659cb41a6e9b38341978043534c9ddbe94dc1e2cf2b6d88145247edd5317c16849079793e38b564716c95fa61a7f918002
-
SSDEEP
24576:Jm1QDQPAu/VRu58dzm7Iv+/G5dAflq3OUfxA/BEoGucPdkToQCdL0:Jm1QcAAtz+I2O5dAt+rowGTBS
Malware Config
Extracted
Family
bumblebee
Botnet
asd1234
rc4.plain
Signatures
-
Detects executables referencing combination of virtualization drivers 2 IoCs
resource yara_rule behavioral1/memory/1620-1-0x0000000000630000-0x0000000000844000-memory.dmp INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb behavioral1/memory/1620-2-0x0000000000630000-0x0000000000844000-memory.dmp INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb -
Detects executables referencing virtualization MAC addresses 2 IoCs
resource yara_rule behavioral1/memory/1620-1-0x0000000000630000-0x0000000000844000-memory.dmp INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb behavioral1/memory/1620-2-0x0000000000630000-0x0000000000844000-memory.dmp INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb