ryuk

General

Target

unique-membership
Size

170KB
Sample

210427-ntmdc7x2rx
MD5

d36a375376e0ad03a104c0230aadf9cc
SHA1

0cf56afc7d75379bce091e30f575a7ef6aeddc3b
SHA256

74362795d3137d99903e1afe062754b1e3f7c5600c54ad5c1ccd76a1f2978ddc
SHA512

184888270df2a3909b6734f5db5cbca9c42cfca068cf2d19f10c158054a05f7bb4fadd4c698f1047482e113df47e83572d9eb83456a78a70d9c86a23ac2ccb9b

Score

10^/10

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note

Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted or deleted or backup disks were formatted. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation No decryption software is available in the public. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. This may lead to the impossibility of recovery of the certain files. To get info (decrypt your files) contact us at [email protected] or [email protected] BTC wallet: 14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk Ryuk No system is safe

Emails

[email protected]

Wallets

14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk

Targets

- Target
  
  unique-membership
- Size
  
  170KB
- MD5
  
  d36a375376e0ad03a104c0230aadf9cc
- SHA1
  
  0cf56afc7d75379bce091e30f575a7ef6aeddc3b
- SHA256
  
  74362795d3137d99903e1afe062754b1e3f7c5600c54ad5c1ccd76a1f2978ddc
- SHA512
  
  184888270df2a3909b6734f5db5cbca9c42cfca068cf2d19f10c158054a05f7bb4fadd4c698f1047482e113df47e83572d9eb83456a78a70d9c86a23ac2ccb9b
Score

10^/10

ryuk persistence ransomware spyware stealer
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1