Overview

overview

7

Static

static

5

Ruth.exe

windows7-x64

7

Ruth.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Ruth.bak

  • Size

    12KB

  • Sample

    241121-nzyk3awnfn

  • MD5

    58f05e9519b3bd825fd6af936f4b2aed

  • SHA1

    be9b785edf541ee1281a39931f7958c031cdccd7

  • SHA256

    16c1391930679d341fea08b889d4dbb3a69d34306cc444b2a628912d10a612c6

  • SHA512

    b62875a2899dc40765b63fbee126e669e9bd287439b09470e5f3010d7b697d59b71ba41e0b680b265474e3826f2b60cb4bf65ec0a6376bb44b57d773fb827e96

  • SSDEEP

    192:rTgOHx0lM4MAyRroVbp9+XfP7b3gKgpOywgglV6eIFlihu9nHV2DmOQKdQeHPyJt:l8kyuP7b3gHpzizIGUvSHd5aJ

Score
7/10
discoverypersistenceupx

Malware Config

Targets

    • Target

      Ruth.bak

    • Size

      12KB

    • MD5

      58f05e9519b3bd825fd6af936f4b2aed

    • SHA1

      be9b785edf541ee1281a39931f7958c031cdccd7

    • SHA256

      16c1391930679d341fea08b889d4dbb3a69d34306cc444b2a628912d10a612c6

    • SHA512

      b62875a2899dc40765b63fbee126e669e9bd287439b09470e5f3010d7b697d59b71ba41e0b680b265474e3826f2b60cb4bf65ec0a6376bb44b57d773fb827e96

    • SSDEEP

      192:rTgOHx0lM4MAyRroVbp9+XfP7b3gKgpOywgglV6eIFlihu9nHV2DmOQKdQeHPyJt:l8kyuP7b3gHpzizIGUvSHd5aJ

    Score
    7/10
    discoverypersistenceupx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks