ryuk

General

Target

xxx.exe
Size

212KB
Sample

210329-7gnmvf13x6
MD5

af9754aa7c14005973189c09494b50af
SHA1

fd4b1bdbbfc7fe46bfe3d2205641c441f796a03d
SHA256

30aa50598d3a153d842f3861f66cd1a8ee754f850ee2429aa739975536b5be3a
SHA512

c6fdd0b930e573d4b3d94232e2ca624c6d21bff572d237e6f3abd9d26ee0e6eb4db0e9bd1384a5961a5da6fc44d81026534a139696b3ae6688705fa52471f887

Score

10^/10

Malware Config

Extracted

Path

C:\$Recycle.Bin\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = 'ky0SRjh'; $torlink = 'http://rk2zzyh63g5avvii4irkhymha3irblchdfj7prk6zwy23f6kahidkpqd.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://rk2zzyh63g5avvii4irkhymha3irblchdfj7prk6zwy23f6kahidkpqd.onion

Targets

- Target
  
  xxx.exe
- Size
  
  212KB
- MD5
  
  af9754aa7c14005973189c09494b50af
- SHA1
  
  fd4b1bdbbfc7fe46bfe3d2205641c441f796a03d
- SHA256
  
  30aa50598d3a153d842f3861f66cd1a8ee754f850ee2429aa739975536b5be3a
- SHA512
  
  c6fdd0b930e573d4b3d94232e2ca624c6d21bff572d237e6f3abd9d26ee0e6eb4db0e9bd1384a5961a5da6fc44d81026534a139696b3ae6688705fa52471f887
Score

10^/10

ryuk discovery ransomware
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2