ryuk

General

Target

e5240cb911dbff768a00aa266dfb28448181d94b750d108df73c4f56b7ec8cf8
Size

74KB
Sample

240808-taj92azajb
MD5

80dc95ed38a023342bbd0f10f0f1f953
SHA1

12879e4b870fc371dda1018e797e92ed8603f5c5
SHA256

e5240cb911dbff768a00aa266dfb28448181d94b750d108df73c4f56b7ec8cf8
SHA512

fc89b05e450087491dcb0b40be05643df1638aa06b900a59ec969bcbe06d47184add446dcfc7a81e1a969c6a0ebda8f1514db28d0d51abac2d8f2c6c3031d7d6
SSDEEP

1536:R7Ie7TbxIQHYdUbGLwLuPUk3wYUjLjo4YdQTnCWRDLYUqjbBN:R8WTdHYdUbGLFx3wYC/ouT55Y7jX

Score

10^/10

Malware Config

Targets

- Target
  
  8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
- Size
  
  144KB
- MD5
  
  89895cf4c88f13e5797aab63dddf1078
- SHA1
  
  1efc175983a17bd6c562fe7b054045d6dcb341e5
- SHA256
  
  8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a
- SHA512
  
  d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2
- SSDEEP
  
  3072:eOFqYZEtiRjB+OpBmUHkRCBMmn3T/znyS4:eO8xwjBx8UHkt2DJ4
Score

10^/10

ryuk discovery ransomware credential_access spyware stealer
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Renames multiple (151) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2