General
-
Target
2024-08-17_81db8e5c62d176b2088f18499479b548_hijackloader_ryuk
-
Size
1.5MB
-
Sample
240817-qrnf8sxgjh
-
MD5
81db8e5c62d176b2088f18499479b548
-
SHA1
1adbb5b4f2a5685248b4e52e27629b7fc481cc8e
-
SHA256
9189d7a6b7d0ac0af6d8ee651b74f8840bd8d20820260744eebf30dc031c6003
-
SHA512
1070a5e99b34710286a08c305608e9e63b1273900f9cb6021ebb8ebc7c96e4c06a5839673bc208c0aafae76b70fe63f35852e4d4cda6115473d791d52562aa68
-
SSDEEP
24576:XSwi89upzT6YWlqhVMtWPMjyHuL15+TSEPwLipM:XTzwpzT6YPhVlU2H0wSOwLp
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-17_81db8e5c62d176b2088f18499479b548_hijackloader_ryuk.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-17_81db8e5c62d176b2088f18499479b548_hijackloader_ryuk.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt
azov
Targets
-
-
Target
2024-08-17_81db8e5c62d176b2088f18499479b548_hijackloader_ryuk
-
Size
1.5MB
-
MD5
81db8e5c62d176b2088f18499479b548
-
SHA1
1adbb5b4f2a5685248b4e52e27629b7fc481cc8e
-
SHA256
9189d7a6b7d0ac0af6d8ee651b74f8840bd8d20820260744eebf30dc031c6003
-
SHA512
1070a5e99b34710286a08c305608e9e63b1273900f9cb6021ebb8ebc7c96e4c06a5839673bc208c0aafae76b70fe63f35852e4d4cda6115473d791d52562aa68
-
SSDEEP
24576:XSwi89upzT6YWlqhVMtWPMjyHuL15+TSEPwLipM:XTzwpzT6YPhVlU2H0wSOwLp
Score10/10-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-