1455091954ecf9ccd6fe60cb8e982d9cfb4b3dc8414443ccfdfc444079829d56
Classification: Malicious
1455091954ecf9ccd6fe60cb8e982d9cfb4b3dc8414443ccfdfc444079829d56 is a ransomware (Windows 64-bit executable, 159.5 KB). Linked to Ryuk malware.
Detection summary
- 103 antivirus detections (82% detection ratio)
- 0 IDS alerts
- 69 processes observed
- 1 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Malware families: RYUK (S0446)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Trojan.Ransom.Ryuk | Hybrid-Analysis | 2021-04-05 19:45:52 | 2021-04-05 19:45:52 | S0446 Ryuk |
Sample information
- Filenames
- cb0c1248d3899358a375888bb4e8f3fe
- File type
- PE32+ executable (GUI) x86-64, for MS Windows
- Size
- 163328 bytes
- MD5
cb0c1248d3899358a375888bb4e8f3fe- SHA-1
b72e75e9e901a44b655a5cf89cf0eadcaff46037- SHA-256
1455091954ecf9ccd6fe60cb8e982d9cfb4b3dc8414443ccfdfc444079829d56- First indexed
- 2021-04-05 19:45:52
- Last updated
- 2026-10-13 05:42:27
Antivirus detections
| Engine | Detection |
|---|---|
| Bkav | W32.FareitLL.Trojan |
| Elastic | malicious (high confidence) |
| MicroWorld-eScan | Trojan.Ransom.Ryuk.A |
| FireEye | Generic.mg.cb0c1248d3899358 |
| McAfee | Ransom-Ryuk |
| Cylance | Unsafe |
| VIPRE | Trojan.Win32.Generic!BT |
| Sangfor | Suspicious.Win32.Save.a |
| K7AntiVirus | Trojan ( 0053a8931 ) |
| Alibaba | Ransom:Win32/Hermez.af59ec7e |
| K7GW | Trojan ( 0053a8931 ) |
| Cybereason | malicious.8d3899 |
| Cyren | W64/Ransom.Ryuk.A.gen!Eldorado |
| Symantec | Trojan.Cridex |
| ESET-NOD32 | a variant of Win64/Filecoder.T |
| APEX | Malicious |
| Avast | Win64:RansomX-gen [Ransom] |
| ClamAV | Win.Ransomware.Ryuk-6688842-0 |
| Kaspersky | Trojan-Ransom.Win32.Hermez.bs |
| BitDefender | Trojan.Ransom.Ryuk.A |
| NANO-Antivirus | Trojan.Win64.Hermez.fhoncr |
| Paloalto | generic.ml |
| ViRobot | Trojan.Win64.S.Ryuk.163328 |
| Tencent | Win32.Trojan.Hermez.Sxoe |
| Ad-Aware | Trojan.Ransom.Ryuk.A |
| TACHYON | Ransom/W64.Ryuk.163328 |
| Emsisoft | Trojan.Ransom.Ryuk.A (B) |
| Comodo | Malware@#14byhmzg1lr3e |
| DrWeb | Trojan.Encoder.26989 |
| Zillya | Trojan.GenericKD.Win32.160825 |
| TrendMicro | Ransom_RYUK.THHBAAO |
| McAfee-GW-Edition | BehavesLike.Win64.Generic.ch |
| Sophos | Mal/Generic-S + Troj/Ransom-FAF |
| SentinelOne | Static AI - Suspicious PE |
| GData | Win64.Trojan-Ransom.Ryuk.A |
| Jiangmin | Trojan.Encoder.i |
| Avira | HEUR/AGEN.1110011 |
| Gridinsoft | Ransom.Win64.Ransom.sa |
| Arcabit | Trojan.Ransom.Ryuk.A |
| AegisLab | Trojan.Win32.Hermez.trse |
| Microsoft | Ransom:Win32/Ryuk!MSR |
| Cynet | Malicious (score: 100) |
| AhnLab-V3 | Trojan/Win64.Ryukran.R234903 |
| ALYac | Trojan.Ransom.Ryuk |
| MAX | malware (ai score=100) |
| VBA32 | TrojanRansom.Encoder |
| Malwarebytes | Ransom.Ryuk |
| TrendMicro-HouseCall | Ransom_RYUK.THHBAAO |
| Rising | Ransom.Jabaxsta!1.B3AA (CLOUD) |
| Yandex | Trojan.GenAsa!VQ4dbs9CJB4 |
| Ikarus | Trojan-Ransom.Ryuk |
| MaxSecure | Trojan.Malware.121218.susgen |
| Fortinet | W64/Filecoder.T!tr |
| Webroot | W32.Malware.Gen |
| AVG | Win64:RansomX-gen [Ransom] |
| Panda | Trj/CI.A |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Qihoo-360 | Win64/Ransom.Ryuk.HgEASOoA |
| AVG | Win64:MalwareX-gen [Ransom] |
| Alibaba | Ransom:Win32/Hermez.6d0d51ae |
| Antiy-AVL | Trojan[Ransom]/Win32.Lazarus |
| Avast | Win64:MalwareX-gen [Ransom] |
| Avira | TR/Redcap.twhmt |
| CAT-QuickHeal | Ransom.Ryuk.S4761698 |
| CTX | exe.ransomware.ryuk |
| Cynet | Malicious (score: 99) |
| DeepInstinct | MALICIOUS |
| Elastic | Windows.Ransomware.Ryuk |
| F-Secure | Trojan.TR/Redcap.twhmt |
| Detected | |
| Gridinsoft | Ransom.Win64.Generic.oa!s1 |
| Kingsoft | malware.kb.a.991 |
| Lionic | Trojan.Win32.Ryuk.j!c |
| Malwarebytes | Malware.AI.218522461 |
| MaxSecure | Trojan.Malware.324951318.susgen |
| Microsoft | Ransom:Win64/Jabaxsta.C |
| Rising | Ransom.Jabaxsta!1.B3AA (CLASSIC) |
| Skyhigh | BehavesLike.Win64.Generic.ch |
| Sophos | Troj/Ransom-FAF |
| Symantec | Ransom.Hermes |
| Tencent | Malware.Win32.Gencirc.10bdfe90 |
| Trapmine | malicious.moderate.ml.score |
| VBA32 | Trojan.Encoder |
| VIPRE | Trojan.Ransom.Ryuk.A |
| Varist | W64/Ransom.Ryuk.A.gen!Eldorado |
| Xcitium | Malware@#14byhmzg1lr3e |
| ZoneAlarm | Troj/Ransom-FAF |
| alibabacloud | RansomWare |
| huorong | Ransom/LockFile.mn |
| AVG | Win64:Filecoder-B [Ransom] |
| Avast | Win64:Filecoder-B [Ransom] |
| Avira | TR/W64.Filecoder.B |
| ESET-NOD32 | Win64/Filecoder.T trojan |
| F-Secure | Trojan.TR/W64.Filecoder.B |
| K7AntiVirus | Ransomware ( 005d64b41 ) |
| K7GW | Ransomware ( 005d64b41 ) |
| Kingsoft | Win32.Trojan-Ransom.Hermez.bs |
| Lionic | Trojan.Win32.Hermez.trse |
| Malwarebytes | Malware.AI.4060618828 |
| McAfeeD | ti!1455091954EC |
| Skyhigh | BehavesLike.Win64.Injector.ch |
| TrellixENS | Ransom-Ryuk |
| VirIT | Trojan.Win32.GenusT.FGHF |
Network contacts
Process list
| Name | Command line |
|---|---|
| cb0c1248d3899358a375888bb4e8f3fe.exe | |
| cmd.exe | /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\cb0c1248d3899358a375888bb4e8f3fe.exe" /f |
| reg.exe | REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\cb0c1248d3899358a375888bb4e8f3fe.exe" /f |
| taskhost.exe | |
| cmd.exe | /C "%PUBLIC%\window.bat" |
| vssadmin.exe | vssadmin Delete Shadows /all /quiet |
| vssadmin.exe | vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB |
| vssadmin.exe | vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded |
| vssadmin.exe | vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB |
| vssadmin.exe | vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded |
| vssadmin.exe | vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB |
| vssadmin.exe | vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded |
| vssadmin.exe | vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB |
| vssadmin.exe | vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded |
| vssadmin.exe | vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB |
| vssadmin.exe | vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded |
| vssadmin.exe | vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB |
| vssadmin.exe | vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded |
| vssadmin.exe | vssadmin Delete Shadows /all /quiet |
| dwm.exe | |
| cmd.exe | /C "%PUBLIC%\window.bat" |
| vssadmin.exe | vssadmin Delete Shadows /all /quiet |
| vssadmin.exe | vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB |
| vssadmin.exe | vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded |
| vssadmin.exe | vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB |
| vssadmin.exe | vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded |
| vssadmin.exe | vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB |
| vssadmin.exe | vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded |
| vssadmin.exe | vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB |
| vssadmin.exe | vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded |