General
- Target 2025-03-22_b2a31ff4048cc5c9ec4e5d44e742a94b_ryuk
- Size 905KB
- Sample250322-mv5cdavry5
- SHA256 acfe65cf08cb8b8239b27d762f68f6602210b686cd88438a24f6c77d8524ff46
Score
10/10
Malware Config
Targets
-
- Target 2025-03-22_b2a31ff4048cc5c9ec4e5d44e742a94b_ryuk
- Size 905KB
- SHA256 acfe65cf08cb8b8239b27d762f68f6602210b686cd88438a24f6c77d8524ff46
Score10/10-
FlawedGraceRAT
FlawedGrace is a full-featured RAT written in C++.
-
Flawedgracerat family
-
FlawedGraceRat Backdoor
Detects FlawedGraceRat x64 backdoor in memory.
-
FlawedGraceRat Loader
Detects FlawedGraceRat x64 loader in memory.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of SetThreadContext