ryuk

General

Target

boundless-season.exe
Size

115KB
Sample

210422-2zy5vfttea
MD5

d353b1061b2e2c5113f13bf271661bb3
SHA1

0b193cd3216633eaed2cd29d50db6b3d2304fd4b
SHA256

a14dd1e91fd88bd3605d2cef629555ef0fdc9fe945c5ba516d965fa52979cbe6
SHA512

17cfd472c8f49fc5f6ecb252458bb0318c0a50405b31815376f603a7d9152b54dbcbbe3b92bebd0fc542bcfd2e596b812db47345144d4c653bd8be4fbb0ef76f

Score

10^/10

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = 'dS4m6hyc'; $torlink = 'http://hqcqsw6et744hz7tx7rudmerk6fjyifovm6upec4ceqjndbmu34vs6yd.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://hqcqsw6et744hz7tx7rudmerk6fjyifovm6upec4ceqjndbmu34vs6yd.onion

Targets

- Target
  
  boundless-season.exe
- Size
  
  115KB
- MD5
  
  d353b1061b2e2c5113f13bf271661bb3
- SHA1
  
  0b193cd3216633eaed2cd29d50db6b3d2304fd4b
- SHA256
  
  a14dd1e91fd88bd3605d2cef629555ef0fdc9fe945c5ba516d965fa52979cbe6
- SHA512
  
  17cfd472c8f49fc5f6ecb252458bb0318c0a50405b31815376f603a7d9152b54dbcbbe3b92bebd0fc542bcfd2e596b812db47345144d4c653bd8be4fbb0ef76f
Score

10^/10

ryuk discovery ransomware
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Loads dropped DLL
- Modifies file permissions
  discovery
- Drops desktop.ini file(s)
behavioral1