Extracted

• • Target

    bad_boi.exe

  • Size

    376KB

  • MD5

    7d3f19b760cb1958a2c4d9ca7492c406

  • SHA1

    c3fa91438850c88c81c0712204a273e382d8fa7b

  • SHA256

    f8bc1638ec3b04412f708233e8586e1d91f18f6715d68cba1a491d4a7f457da0

  • SHA512

    64d14a7a3866c76d45bea7bee19d40f63241c777d8d259a8a79279cac51396fe9469f28fc68eaa8ab688af13a47c4c5af0d62005d93a4649f81e411b8f2eae91

  • SSDEEP

    6144:jwHqh+1uu3RVmPY55eExdAev5wuSiRqAO1iNgLTBs4LhVJqRcelLQMo8:P+1uu3RVmPYaad5wuSiRqLNeRcZMo8

  Score

  10^/10

  ryukcredential_accessdavediscoveryransomwarestealer

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk

  • Ryuk family

    ryuk

  • Renames multiple (8298) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Dave packer

    Detects executable using a packer named 'Dave' by the community, based on a string at the end.

    dave

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Drops desktop.ini file(s)

  behavioral1behavioral2