Overview

overview

9

Static

static

7

ryomen-gen.rar

windows7-x64

3

ryomen-gen.rar

windows10-2004-x64

3

ryomen-gen...g.json

windows7-x64

3

ryomen-gen...g.json

windows10-2004-x64

3

ryomen-gen...gs.vbs

windows7-x64

1

ryomen-gen...gs.vbs

windows10-2004-x64

1

ryomen-gen...ol.exe

windows7-x64

7

ryomen-gen...ol.exe

windows10-2004-x64

7

out.exe

windows7-x64

out.exe

windows10-2004-x64

ryomen-gen...ol.ini

windows7-x64

1

ryomen-gen...ol.ini

windows10-2004-x64

1

ryomen-gen...me.txt

windows7-x64

1

ryomen-gen...me.txt

windows10-2004-x64

1

ryomen-gen/ryomen.exe

windows7-x64

9

ryomen-gen/ryomen.exe

windows10-2004-x64

9

ryomen.pyc

windows7-x64

3

ryomen.pyc

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ryomen-gen.rar

  • Size

    22.2MB

  • Sample

    240812-cdv29svajh

  • MD5

    eb34faf223e0593869a72a704f761d59

  • SHA1

    3db40b8a4a2f5fb492bc25096ecc44cd22e3dee8

  • SHA256

    c375e2d213b316fa300470a4cfc29588e87e52d7ee381d38b6de3ee2d800a113

  • SHA512

    46c63c93202fd8c66ceaff5a7b44d678b750dce9b74ccdeceab0392ec5a94cecf6ebd2fc609b219a669cf713608b3d02ba9159829e15de38b00e53383574ba69

  • SSDEEP

    393216:JIvo1MtEdy5l/ua/dHTn5BrC1J2lA8E5LRYXacoCbkbFCavAaFmZY:GvoeWA5l/b/pnkJ2W8E5LRcoCbenvA6P

Score
9/10
discoveryevasionthemidatrojanupx

Malware Config

Targets

    • Target

      ryomen-gen.rar

    • Size

      22.2MB

    • MD5

      eb34faf223e0593869a72a704f761d59

    • SHA1

      3db40b8a4a2f5fb492bc25096ecc44cd22e3dee8

    • SHA256

      c375e2d213b316fa300470a4cfc29588e87e52d7ee381d38b6de3ee2d800a113

    • SHA512

      46c63c93202fd8c66ceaff5a7b44d678b750dce9b74ccdeceab0392ec5a94cecf6ebd2fc609b219a669cf713608b3d02ba9159829e15de38b00e53383574ba69

    • SSDEEP

      393216:JIvo1MtEdy5l/ua/dHTn5BrC1J2lA8E5LRYXacoCbkbFCavAaFmZY:GvoeWA5l/b/pnkJ2W8E5LRcoCbenvA6P

    Score
    3/10
    behavioral1behavioral2

    • Target

      ryomen-gen/config.json

    • Size

      61B

    • MD5

      4e5ef75272ab12c993b68996ce50bca4

    • SHA1

      31d17b2adf0e8f272b179d2fd2994e35ec30490c

    • SHA256

      3fc0e76c1a731f056d4a3cefe628a6543bb62f9ab0c3e7fe773f4bafe0ccb1f4

    • SHA512

      97a965db6be0a3ba4684ac6b7354d519e0ad5fc659265ac1edd1278e26feab63ea71706261c478992dbf0dd1b24fc4e846e7d5fe7bcd66de8b47fdb031e569d9

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      ryomen-gen/dcontrol/Defender_Settings.vbs

    • Size

      313B

    • MD5

      b0bf0a477bcca312021177572311e666

    • SHA1

      ea77332d7779938ae8e92ad35d6dea4f4be37a92

    • SHA256

      af42a17d428c8e9d6f4a6d3393ec268f4d12bbfd01a897d87275482a45c847e9

    • SHA512

      09366608f2670d2eb0e8ddcacd081a7b2d7b680c4cdd02494d08821dbdf17595b30e88f6ce0888591592e7caa422414a895846a268fd63e8243074972c9f52d8

    Score
    1/10
    behavioral5behavioral6

    • Target

      ryomen-gen/dcontrol/dControl.exe

    • Size

      447KB

    • MD5

      58008524a6473bdf86c1040a9a9e39c3

    • SHA1

      cb704d2e8df80fd3500a5b817966dc262d80ddb8

    • SHA256

      1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326

    • SHA512

      8cf492584303523bf6cdfeb6b1b779ee44471c91e759ce32fd4849547b6245d4ed86af5b38d1c6979729a77f312ba91c48207a332ae1589a6e25de67ffb96c31

    • SSDEEP

      6144:Vzv+kSn74iCmfianQGDM3OXTWRDy9GYQDUmJFXIXHrsUBnBTF8JJCYrYNsQJzfgu:Vzcn7EanlQiWtYhmJFSwUBLcQZfgiD

    Score
    7/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    behavioral7behavioral8

    • Target

      out.upx

    • Size

      653KB

    • MD5

      6970ea0b6597dcd5b4f5f19f28e958a8

    • SHA1

      a0130bb7ac03ec4799c90781ca93fd1392c6d54c

    • SHA256

      481e03978ca339ce697252895efe89b09fefd3098ad247d24eeb6cca9969f553

    • SHA512

      bc95cbe9a050e3d3b713745ef399bf2817d38f8e019f6edffdd2bf755badbde766e434e39a7f32356125bba0692b694c18da8dd0762aac0c9430d45acb215e01

    • SSDEEP

      12288:nkxDoouVA2nxKkhEvdRgQriDJOIlW+yBGQowlNCWS:RRmJkioQrilOIc+yMx

    Score
    1/10
    behavioral10behavioral9

    • Target

      ryomen-gen/dcontrol/dControl.ini

    • Size

      85KB

    • MD5

      05450ff06366ae22654b63a6e27d1624

    • SHA1

      11453c370f41287fb6339e509bb9d3c91842b379

    • SHA256

      8e9a84da243905685ca77b6ef71841e610b88b7963d4de59f6dcbdd1621ecacd

    • SHA512

      ee0a9605b566aa89c8c9b260e1d9c15aecbd6cddc2df47fe24ef2cafbe8923b3e025bd5cd3d34499292589a3c094dd796ab4560c8099bad2051a54928c37b4b2

    • SSDEEP

      768:i/G+NmPfjsxaxdk2akexodULxEQq1wIgC+AEbSr6:1+NyjsxkKdkJdULgbWSO

    Score
    1/10
    behavioral11behavioral12

    • Target

      ryomen-gen/read-me.txt

    • Size

      447B

    • MD5

      036d9458fec7dcff1a95e5e49a89be90

    • SHA1

      7efe9f70fd370520cc0bcaa386f6103fe5edc249

    • SHA256

      0d19c6c29176a36717ca857348ec44608d14ba33a6a211490c06547dae06b75a

    • SHA512

      fe93ab6c1b0d9b4473e257289598a0f548c37f312f60c5376babbc9f22a6189ee7b4d5c7fc1c215e75ba6e3d76694819db09eecee5f1cd01f1de278e40bd4f7a

    Score
    1/10
    behavioral13behavioral14

    • Target

      ryomen-gen/ryomen.exe

    • Size

      21.9MB

    • MD5

      30ce892010db9f56f0ed936cfc129f30

    • SHA1

      58c3e72b0e782990885d665c2bae00990b036275

    • SHA256

      b8c2f0eba9dccb3a8a634fc9844a9d1a5794b74de9753a0e5ba16c4099d2276b

    • SHA512

      b3c75cb6171921bafdb8fb27f0367d99e6cf2024ad310407d421d19465ad91580b4e54b8c623ec45d55aac333b46fd6cc4ce0ed834903f20ef4c043322398beb

    • SSDEEP

      393216:QWV3KB/MQNuBhQNCEDsSmVcamu9UJMZk4exVbMBVd2RW8aJX2Z6:QmaZMQQWCEDFmVcgi2Zk93bMzMCJa

    Score
    9/10
    evasionthemidatrojandiscovery

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral15behavioral16

    • Target

      ryomen.pyc

    • Size

      13KB

    • MD5

      d0b035072cc904311841848e8b9cbdc4

    • SHA1

      9e4ca44e796cc2836f79e1c3e4be036234ccfe36

    • SHA256

      9daf11520957ee1e9bd446ce6bbbc473318f6f48e98d8ccfa36a00379a1b45f6

    • SHA512

      f9783025f0f9b0b702327dc45045440fc27e9a97134fce555bc3da7af89379cd7df1429336f780bb99c8c51e5b2f8707f5d892a3d8b57555f20f4b0f806516e5

    • SSDEEP

      192:oLZg6jPB3MLw237AePzaYR+NnwSXCkYyLXRi/54X4mRK0UZcB+WqAq38:oLBcz37AIzfRUwSSoNA5M4mM0Ugvss

    Score
    3/10
    discovery
    behavioral17behavioral18

MITRE ATT&CK Enterprise v15

Tasks