Extracted

• • Target

    2024-12-10_7bcbd03a264f616bcbf64dd973c9e120_luca-stealer_ryuk

  • Size

    378KB

  • MD5

    7bcbd03a264f616bcbf64dd973c9e120

  • SHA1

    5d2b6c04f634672ba0a11063dd1bc225446af2c2

  • SHA256

    8f6bddd131f27472a4b974c3a141f8eba3a2c110b4b19d755408f67aed212b68

  • SHA512

    f5b1dc62441d9bfdb57a7ae6ef41c46106e510ba73cea8372cc0a2765c192d27dc3f41c1dfadadcaaa39ff4fd87b0c84b81ecd3b14c8315edeca3dd0a8789242

  • SSDEEP

    6144:sMfwnT2W/Pw5qjylH1/7QXMWibyJp/qQ:snTzPqHkiuX

  Score

  10^/10

  ryukdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk

  • Ryuk family

    ryuk

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery
  behavioral1behavioral2