Extracted

• • Target

    2025-03-12_8d37a57790a7686b1f6a0dc87164403c_ryuk

  • Size

    11.1MB

  • MD5

    8d37a57790a7686b1f6a0dc87164403c

  • SHA1

    3c3676398699ca77d7d0c091511090fe741e70f3

  • SHA256

    8392d43e670759e8cecd9a68315de311af60b0f7ac60ca7e14731de2b1e4e6c8

  • SHA512

    00dee3e1369012feae29298762d65acea7f530472d5b181ccb49734a8654313f708fe3839309d11ebcb2c5871d738dd287d5d70cdae7f8f8bf0196d996fca087

  • SSDEEP

    196608:WjPEzA/jerrNGD7+Ht2JneMeR5U8kB1eLOPwdrhEVSL2v8hpffR5vSGRNJpoEzoG:qPeAe8+0nQDQBPw5aVSLo8phZS0yEEC1

  Score

  10^/10

  bitratdiscoveryexecutionpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Bitrat family

    bitrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2