Extracted

• • Target

    7faeb64c50cd15d036ca259a047d6c62ed491fff3729433fefba0b02c059d5ed.exe

  • Size

    273KB

  • MD5

    0eed6a270c65ab473f149b8b13c46c68

  • SHA1

    bffb380ef3952770464823d55d0f4dfa6ab0b8df

  • SHA256

    7faeb64c50cd15d036ca259a047d6c62ed491fff3729433fefba0b02c059d5ed

  • SHA512

    1edc5af819e0a604bef31bca55efeea4d50f089aa6bdd67afee00a10132b00172a82cda214ea0ca8164b8d7444d648984c27c45f27acc69e227188ec25064aff

  • SSDEEP

    3072:n/YRw64GUbH9dpWYEFq5hY9e1Z36NS31gs03ApyCb6DnE/PdrfS6sOK5hI+z7XI:Qa6owYEFq5hY9aqNS1y4/PdzS+s64I

  Score

  10^/10

  ryukcredential_accessdiscoveryransomwarestealerspyware

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk

  • Ryuk family

    ryuk

  • Renames multiple (8041) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2