General

  • Target

    2024-05-20_8e33549cac1c6e53401b9bb762766b63_ryuk_zxxz

  • Size

    54.7MB

  • MD5

    8e33549cac1c6e53401b9bb762766b63

  • SHA1

    e33e81fe80e5215417af063edac6d47035cd3b61

  • SHA256

    4d3d6a16a5286fbca323909b2f26431c72a8367b298a7faf3673d9c15a2d1530

  • SHA512

    3ae12be64ecb77c8751d0bfc67b6a61d5a59d1ec1add4a81a35eaa4b96ebfd401b87729256b5542986bd893193ef84afe9e23456e5d6ea52dee716e0913b6470

  • SSDEEP

    196608:mBcEHHTbZryT4lrcuYpj9mIa91en8LnuIIBZmBUuUZ+mFoFx91/czEtkD9jxtN:QTHvZEUcuYy91I8MLtfn2/fczE+N

Score
10/10

Malware Config

Signatures

  • Detects executables Discord URL observed in first stage droppers 1 IoCs
  • Detects executables referencing many IR and analysis tools 1 IoCs
  • Detects executables referencing virtualization MAC addresses 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2024-05-20_8e33549cac1c6e53401b9bb762766b63_ryuk_zxxz
    .exe windows:6 windows x64 arch:x64

    d11ec34fab51506af942d8d7eab35025


    Headers

    Imports

    Sections