2ec5256a7edb90b1c05c92f79e8a48c205b29e1ac910a535aa83c30b8dbbeff8
Classification: Malicious
2ec5256a7edb90b1c05c92f79e8a48c205b29e1ac910a535aa83c30b8dbbeff8 is a ransomware (Windows executable, 134.5 KB). Linked to Ryuk malware.
Detection summary
- 86 antivirus detections (77% detection ratio)
- 0 IDS alerts
- 41 processes observed
- 0 contacted hosts
- 0 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Generic Malware |
Cyber Threat Alliance |
2025-09-03 10:16:05 |
2025-09-03 10:16:05 |
|
|
| Generic Malware |
Hybrid-Analysis |
2023-06-15 22:30:04 |
2023-06-15 22:30:04 |
|
|
| Ransom.Ryuk |
Hybrid-Analysis |
2020-11-05 19:00:10 |
2020-11-05 19:00:10 |
|
S0446 Ryuk
|
Tags
evasive
windows-server-utility
Sample information
- Filenames
- 2ec5256a7edb90b1c05c92f79e8a48c205b29e1ac910a535aa83c30b8dbbeff8.exe
- File type
- PE32 executable (GUI) Intel 80386, for MS Windows
- Size
- 137680 bytes
- MD5
a5c70086b3bc4fe64f4e7a0aa452e620- SHA-1
2ab44cf5338ef5ed118365b4e8452b906c0dab4b- SHA-256
2ec5256a7edb90b1c05c92f79e8a48c205b29e1ac910a535aa83c30b8dbbeff8- First indexed
- 2020-11-05 19:00:10
- Last updated
- 2026-09-10 04:01:37
Antivirus detections
| Engine | Detection |
|---|
| Lionic | Trojan.Win32.Cryptor.j!c |
| Elastic | malicious (high confidence) |
| MicroWorld-eScan | Gen:Variant.Jatif.1733 |
| FireEye | Gen:Variant.Jatif.1733 |
| McAfee | Ransom-Ryuk!A5C70086B3BC |
| Cylance | Unsafe |
| Sangfor | Suspicious.Win32.Save.a |
| K7AntiVirus | Trojan ( 0057029d1 ) |
| Alibaba | Ransom:Win32/Cryptor.e7e62172 |
| K7GW | Trojan ( 0057029d1 ) |
| Cybereason | malicious.6b3bc4 |
| VirIT | Trojan.Win32.Encoder.BWPL |
| Cyren | W32/Trojan.SPRB-2372 |
| Symantec | Ransom.Ryuk |
| ESET-NOD32 | a variant of Win32/Filecoder.Ryuk.J |
| Paloalto | generic.ml |
| ClamAV | Win.Ransomware.Ryuk-9779552-0 |
| Kaspersky | HEUR:Trojan-Ransom.Win32.Cryptor.gen |
| BitDefender | Gen:Variant.Jatif.1733 |
| NANO-Antivirus | Trojan.Win32.Cryptor.iawwgy |
| Avast | Win32:DangerousSig [Trj] |
| Tencent | Malware.Win32.Gencirc.11b0a42e |
| Ad-Aware | Gen:Variant.Jatif.1733 |
| TACHYON | Ransom/W32.Ryuk.137680 |
| Sophos | Mal/Generic-R + Troj/Ryuk-BK |
| Comodo | Malware@#2sem4rco6ce2w |
| DrWeb | Trojan.Encoder.32849 |
| Zillya | Trojan.Filecoder.Win32.16713 |
| TrendMicro | Ransom.Win32.RYUK.SMA.hp |
| McAfee-GW-Edition | Ransom-Ryuk!A5C70086B3BC |
| Emsisoft | MalCert-S.DA (A) |
| GData | Gen:Variant.Jatif.1733 |
| Jiangmin | Trojan.Cryptor.te |
| Webroot | W32.Ransom.Ryuk |
| Avira | HEUR/AGEN.1213033 |
| Kingsoft | Win32.Troj.Undef.(kcloud) |
| Gridinsoft | Ransom.Win32.Generic.oa!s1 |
| Arcabit | Trojan.Jatif.D6C5 |
| Microsoft | Trojan:MSIL/Cryptor |
| Cynet | Malicious (score: 99) |
| AhnLab-V3 | Trojan/Win32.Ryukran.R353385 |
| VBA32 | TrojanRansom.Cryptor |
| MAX | malware (ai score=94) |
| Malwarebytes | Ransom.Ryuk |
| TrendMicro-HouseCall | Ransom.Win32.RYUK.SMA.hp |
| Rising | [email protected] (RDML:c2EazHxneWQsAlLVL+D3Sg) |
| Yandex | Trojan.Filecoder!634yGR7OkNA |
| Ikarus | Trojan-Ransom.Ryuk |
| Fortinet | W32/Mikey.118406!tr.ransom |
| BitDefenderTheta | Gen:NN.ZexaF.34682.iqY@aazFVeh |
| AVG | Win32:DangerousSig [Trj] |
| Panda | Trj/CI.A |
| CrowdStrike | win/malicious_confidence_100% (W) |
| ALYac | Trojan.Ransom.Ryuk |
| Alibaba | Ransom:Win32/Cryptor.18f840ba |
| Antiy-AVL | Trojan[Ransom]/Win32.Ryuk |
| Arcabit | Trojan.Ransom.Ryuk.54 |
| Avira | TR/Ransom.Ryuk.okshy |
| BitDefender | Gen:Variant.Ransom.Ryuk.54 |
| Bkav | W32.Common.95519E27 |
| CAT-QuickHeal | Trojan.Ghanarava.171802319252e620 |
| CTX | exe.ransomware.ryuk |
| DeepInstinct | MALICIOUS |
| F-Secure | Trojan.TR/Ransom.Ryuk.okshy |
| GData | Gen:Variant.Ransom.Ryuk.54 |
| Google | Detected |
| K7AntiVirus | Trojan ( 005aa3621 ) |
| K7GW | Trojan ( 005aa3621 ) |
| Malwarebytes | Malware.AI.256501594 |
| MaxSecure | Trojan.Malware.73657187.susgen |
| McAfeeD | ti!2EC5256A7EDB |
| MicroWorld-eScan | Gen:Variant.Ransom.Ryuk.54 |
| Microsoft | Ransom:Win32/Ryuk!MSR |
| Rising | Trojan.Filecoder!8.68 (TFE:5:igFCKwza70E) |
| Sangfor | Ransom.Win32.Ryuk.Vrak |
| Skyhigh | Ransom-Ryuk!A5C70086B3BC |
| Sophos | Troj/Ryuk-BK |
| Symantec | ML.Attribute.HighConfidence |
| Tencent | Malware.Win32.Gencirc.10bf3f37 |
| TrellixENS | Ransom-Ryuk!A5C70086B3BC |
| VIPRE | Gen:Variant.Ransom.Ryuk.54 |
| Varist | W32/Trojan.SPRB-2372 |
| Xcitium | Malware@#2sem4rco6ce2w |
| ZoneAlarm | Troj/Ryuk-BK |
| alibabacloud | Ransomware:Win/Ryuk.J |
| huorong | Ransom/Ryuk.f |
Process list
| Name | Command line |
|---|
| 2ec5256a7edb90b1c05c92f79e8a48c205b29e1ac910a535aa83c30b8dbbeff8.exe | |
| lOQIgAurklan.exe | 8 LAN |
| CQWxnKZYplan.exe | 8 LAN |
| GKwkNRbXGlan.exe | 8 LAN |
| icacls.exe | icacls "C:\*" /grant Everyone:F /T /C /Q |
| icacls.exe | icacls "D:\*" /grant Everyone:F /T /C /Q |
| icacls.exe | icacls "Z:\*" /grant Everyone:F /T /C /Q |
| net.exe | stop "audioendpointbuilder" /y |
| net1.exe | %WINDIR%\system32\net1 stop "audioendpointbuilder" /y |
| net.exe | stop "samss" /y |
| net1.exe | %WINDIR%\system32\net1 stop "samss" /y |
| net.exe | stop "audioendpointbuilder" /y |
| net1.exe | %WINDIR%\system32\net1 stop "audioendpointbuilder" /y |
| net.exe | stop "samss" /y |
| net1.exe | %WINDIR%\system32\net1 stop "samss" /y |
| net.exe | stop "samss" /y |
| net1.exe | %WINDIR%\system32\net1 stop "samss" /y |
| net.exe | stop "samss" /y |
| net1.exe | %WINDIR%\system32\net1 stop "samss" /y |
| DismHost.exe | {7D0B4510-9B1D-4C01-B316-771CAC5185D4} |
| 2ec5256a7edb90b1c05c92f79e8a48c205b29e1ac910a535aa83c30b8dbbeff8.exe | |
| yvPzWaDSvlan.exe | 8 LAN |
| HYiKnEVEQlan.exe | 8 LAN |
| zELPBxNwclan.exe | 8 LAN |
| icacls.exe | icacls "C:\*" /grant Everyone:F /T /C /Q |
| icacls.exe | icacls "D:\*" /grant Everyone:F /T /C /Q |
| icacls.exe | icacls "Z:\*" /grant Everyone:F /T /C /Q |
| taskkill.exe | /IM onenotem.exe /F |
| taskkill.exe | /IM onenotem.exe /F |
| net.exe | stop "audioendpointbuilder" /y |