General
-
Target
2024-06-06_4b0a0a61171188ea26cd3ee208362557_ryuk
-
Size
664KB
-
Sample
240606-gar9eshf8v
-
MD5
4b0a0a61171188ea26cd3ee208362557
-
SHA1
6f9407d5eb319732426b88845093a0ad4bf5778f
-
SHA256
c431626df5db511cf1d1b01ce707ee86b14a950fbf2343d12bc4fcf3cdc58010
-
SHA512
2c9993ecde7c4872bc07792cc1fa4b885522215d5d965581273af6063084559b601fe97f75cb752bd430b0e6e24a1a0f792cc0a63ffe4994e9b9b748723a185d
-
SSDEEP
12288:Ks9vcloSoCU5qJSr1ezgEU6s6oKdzFMzxgoAQHUzTshhKIrEI:BLSoCU5qJSr1ekEfLdzFMzxgoFeTeKKf
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-06_4b0a0a61171188ea26cd3ee208362557_ryuk.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-06_4b0a0a61171188ea26cd3ee208362557_ryuk.exe
Resource
win10v2004-20240426-en
Malware Config
Targets
-
-
Target
2024-06-06_4b0a0a61171188ea26cd3ee208362557_ryuk
-
Size
664KB
-
MD5
4b0a0a61171188ea26cd3ee208362557
-
SHA1
6f9407d5eb319732426b88845093a0ad4bf5778f
-
SHA256
c431626df5db511cf1d1b01ce707ee86b14a950fbf2343d12bc4fcf3cdc58010
-
SHA512
2c9993ecde7c4872bc07792cc1fa4b885522215d5d965581273af6063084559b601fe97f75cb752bd430b0e6e24a1a0f792cc0a63ffe4994e9b9b748723a185d
-
SSDEEP
12288:Ks9vcloSoCU5qJSr1ezgEU6s6oKdzFMzxgoAQHUzTshhKIrEI:BLSoCU5qJSr1ekEfLdzFMzxgoFeTeKKf
Score10/10-
Renames multiple (120) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-