General
-
Target
2025-01-31_8bda6282f7e39d82bb1f3317275213be_ryuk
-
Size
1.7MB
-
Sample
250131-ceernsxlgz
-
MD5
8bda6282f7e39d82bb1f3317275213be
-
SHA1
d0d728dd9ae4144d3069decf0af8335396a11bcc
-
SHA256
f57c80600b30bc42479bd48d135be233769d6169dbee3000bf657d2e81f07878
-
SHA512
6e715b8ce4b78beacd2297d662b71a383d8dc648751a9de573a5a8ad87880aa0d7520d295c6940876415dedc788c2bede7e8ce0668896b4155d6a07247cb5e16
-
SSDEEP
49152:xDkyVkAesRniCW55/gXNBcYtLlrtCCTCdfQ:xksRnBYyNBplhCTK
Static task
static1
Behavioral task
behavioral1
Sample
2025-01-31_8bda6282f7e39d82bb1f3317275213be_ryuk.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2025-01-31_8bda6282f7e39d82bb1f3317275213be_ryuk.exe
Resource
win10v2004-20250129-en
Malware Config
Extracted
C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt
azov
Targets
-
-
Target
2025-01-31_8bda6282f7e39d82bb1f3317275213be_ryuk
-
Size
1.7MB
-
MD5
8bda6282f7e39d82bb1f3317275213be
-
SHA1
d0d728dd9ae4144d3069decf0af8335396a11bcc
-
SHA256
f57c80600b30bc42479bd48d135be233769d6169dbee3000bf657d2e81f07878
-
SHA512
6e715b8ce4b78beacd2297d662b71a383d8dc648751a9de573a5a8ad87880aa0d7520d295c6940876415dedc788c2bede7e8ce0668896b4155d6a07247cb5e16
-
SSDEEP
49152:xDkyVkAesRniCW55/gXNBcYtLlrtCCTCdfQ:xksRnBYyNBplhCTK
Score10/10-
Azov family
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-