Extracted

• • Target

    rudZqlH.exe

  • Size

    254KB

  • MD5

    4540720d38ed99bceeb97161ca1ff401

  • SHA1

    5714dfd839db561ebcb3cccfcb6f0e39ef644f7b

  • SHA256

    4a87552c4238cdcf1b8611da467164e609da339ff897c50ad4d04aa105ec55bb

  • SHA512

    2be902451da4262ed9899ecd570e12f31516f4d937909ee8e99f2c5dfcdbd7a218cc4eda494357678067ccc58a674944d08150248707a96e7d64ff01b83f0dbf

  • SSDEEP

    3072:jrfwrgyViUc2LHCGwb4EVI3KwyuREPPg3Ubb5eW9OOH3F7ZHWAAf:vfgVNVbJ64EVKKXuREw33oHzuf

  Score

  10^/10

  ryukcredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarestealer

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk

  • Ryuk family

    ryuk

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (5245) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence
  behavioral1behavioral2