Extracted

• • Target
    2025-10-20_61db0c0046478a5c8c91620eda21e395_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer_smoke-loader
  • Size 376KB
  • SHA256 4e0675d234a7da040e6ee6814cf21b26fdfe49ee30ad30386927dcea074a2d79
  • MD5 61db0c0046478a5c8c91620eda21e395
  • SHA1 38941c50042255d8fc318c0a9ab18a848a0e3bff
  • SHA512 081f94ad3289344575644a05e1cd089e9f52e2631cc7d147e733304b7c072b14b6e49389937edec216b0c614e969b6a81de912c48be621d29c3cd0acee69d4f2
  • SSDEEP 6144:jwmqh+1uu3RVmPY55eExdAev5wuSiRqAO1iNgLTBs4LhVJqRcelLQMo8:8+1uu3RVmPYaad5wuSiRqLNeRcZMo8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  davediscoveryryukransomware

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk

  • Ryuk family

    ryuk

  • Renames multiple (584) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Dave packer

    Detects executable using a packer named 'Dave' by the community, based on a string at the end.

    dave

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies file permissions

    discovery
  behavioral1behavioral2