Extracted

• • Target

    b3846bc61ca63d9c10d6f559688e366061ae98fcbe82076b9e557b0beec6f327

  • Size

    115KB

  • MD5

    d736f4a3fc844b4a7e970b562fbeac85

  • SHA1

    fdd13c9b9e6c0e07f1215780c4ab742627e57917

  • SHA256

    b3846bc61ca63d9c10d6f559688e366061ae98fcbe82076b9e557b0beec6f327

  • SHA512

    7ee0ba7a2df6cc294b9955279bbfbfe7f3e167dc208b7d9290ba67bb0c516b228d1b75c7eeebcdb9090b85e8267d239889c3ad12718a281978a1aa00ad8509fe

  • SSDEEP

    1536:3xmseXNzlgZnb5hRfLkLBPYeP6df854o9At8fLKnYpPuQ0sWtmcd+WEspNmKiSxP:3q52hMWI6df84o6atWH+pImKiSxP

  Score

  10^/10

  ryukdefense_evasiondiscoveryexecutionimpactpersistenceransomware

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk

  • Ryuk family

    ryuk

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (7368) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2