ryuk

General

Target

60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025
Size

136KB
Sample

210410-rryxzgpys2
MD5

45295780f2ba837be42ccf50710bd2b5
SHA1

f937b1b7b3593a38702f870077658a891974edda
SHA256

60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025
SHA512

588666aa108f01334c2e0adc03aa68d5e3ebb68ee773939b668a5a6ca1eacf03570b7608d4ca3c936dd7f7ec6edd4063a05b1cef7d446661c8f00f8520e72f8b

Score

10^/10

Malware Config

Extracted

Path

C:\$Recycle.Bin\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = 'spyZ3Hxws'; $torlink = 'http://smtpys6pvcvdvram6xucwecfv7rdhs6fmxzivrbcrncdeiphryhb75id.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://smtpys6pvcvdvram6xucwecfv7rdhs6fmxzivrbcrncdeiphryhb75id.onion

Targets

- Target
  
  60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025
- Size
  
  136KB
- MD5
  
  45295780f2ba837be42ccf50710bd2b5
- SHA1
  
  f937b1b7b3593a38702f870077658a891974edda
- SHA256
  
  60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025
- SHA512
  
  588666aa108f01334c2e0adc03aa68d5e3ebb68ee773939b668a5a6ca1eacf03570b7608d4ca3c936dd7f7ec6edd4063a05b1cef7d446661c8f00f8520e72f8b
Score

10^/10

ryuk discovery ransomware
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2