ryuk

General

Target

8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.zip
Size

74KB
Sample

250127-wbzr8azley
MD5

589ce36d3f8639c15d29fbb3cf1eb3c8
SHA1

f5dffb1f4c6722adafa6ee61283be7cc7cabc3e1
SHA256

5cec84a4e0b4aa50c9cb78a96b63e542ed2121f6f3a35e40df7cf453d8fa2d3a
SHA512

1d27d1e38b3eefa0c5da5bc17a9fa2c66af205dadba62f946f63617ab67529b988dd69fc9079ec156d3d46e295015555653cac864477fb02d655ff18da14d825
SSDEEP

1536:QyK9JZl0yoiKItc6m4KmXhNNfpYnS7f2W/XmUdZY:PKn0RZItc5t4NfpYSXXW

Score

10^/10

Malware Config

Targets

- Target
  
  8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
- Size
  
  144KB
- MD5
  
  89895cf4c88f13e5797aab63dddf1078
- SHA1
  
  1efc175983a17bd6c562fe7b054045d6dcb341e5
- SHA256
  
  8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a
- SHA512
  
  d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2
- SSDEEP
  
  3072:eOFqYZEtiRjB+OpBmUHkRCBMmn3T/znyS4:eO8xwjBx8UHkt2DJ4
Score

10^/10

ryuk credential_access discovery ransomware stealer spyware
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Ryuk family
  ryuk
- Renames multiple (8036) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2