ryuk

General

Target

5986509239648256.zip
Size

66KB
Sample

210330-gg17yc3aqe
MD5

3a1b20ddfe25786b7d184422df213d22
SHA1

4159d0d10773820f864e51269196f4696543812b
SHA256

8ab6ffe813edc1e7e54486294ecdeeeadd2bf4ac3114eaae17e5c8a02eb0ee9d
SHA512

16c9a8825773d2f587d78ee49264356aa4a4538d6b5f7222bef0c820231af851cb256efde6af42605d1e32b5fbc50a79f884920d63b2f8700f346356b8e91993

Score

10^/10

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = 'kfXg4XYqb'; $torlink = 'http://piesa6sapybbrz63pqmmwdzyc5fp73b3uya5cpli6pp5jpswndiu44id.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://piesa6sapybbrz63pqmmwdzyc5fp73b3uya5cpli6pp5jpswndiu44id.onion

Targets

- Target
  
  a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2
- Size
  
  124KB
- MD5
  
  45e3bef94fdefd78f8e6bcedd5f43715
- SHA1
  
  b875676f6eaf9fd3d9105303015b6d60e7c919a8
- SHA256
  
  a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2
- SHA512
  
  15f90b3be77324ca0e7cd1d487fc5b971782facb528c88e55bb63c30d76106fd941a30bbedd07755089b6d55a2852e82c896ff0f7c0a188b59b20c4ee6543e17
Score

10^/10

ryuk discovery ransomware
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2