Description
Ransomware distributed via existing botnets, often Trickbot or Emotet.
General
Target
Size
Sample
f130530949c0e3adca48ba558980b634c0a78c8faa5572718b665cc7abfd7703.bin.sample
170KB
211020-kyf3vahgdj
Score
10/10
MD5
SHA1
SHA256
SHA512
1bd7d1b87c5091a9653fe8005892b784
3dcf19b833266a3591fd97c93e5b9bca4ac2c21c
f130530949c0e3adca48ba558980b634c0a78c8faa5572718b665cc7abfd7703
4c13373a150b1e3bd12fdd9ad5c379a43e41c59ba5b6dd6982c79599839128bcbde30d7083a810d66604382f4d5aff24c22b504fdaab03f6743a7dc263d85651
Malware Config
Extracted
| Path | C:\RyukReadMe.txt |
| Family | ryuk |
| Ransom Note |
Your network has been penetrated.
All files on each host in the network have been encrypted with a strong algorithm.
Backups were either encrypted or deleted or backup disks were formatted.
Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover.
We exclusively have decryption software for your situation
No decryption software is available in the public.
DO NOT RESET OR SHUTDOWN - files may be damaged.
DO NOT RENAME OR MOVE the encrypted and readme files.
DO NOT DELETE readme files.
This may lead to the impossibility of recovery of the certain files.
To get info (decrypt your files) contact us at
WayneEvenson@protonmail.com
or
WayneEvenson@tutanota.com
BTC wallet:
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Ryuk
No system is safe
|
| Emails |
WayneEvenson@protonmail.com WayneEvenson@tutanota.com |
| Wallets |
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk |
Targets
Target
MD5
Filesize
f130530949c0e3adca48ba558980b634c0a78c8faa5572718b665cc7abfd7703.bin.sample
1bd7d1b87c5091a9653fe8005892b784
170KB
Score
10/10
SHA1
SHA256
SHA512
3dcf19b833266a3591fd97c93e5b9bca4ac2c21c
f130530949c0e3adca48ba558980b634c0a78c8faa5572718b665cc7abfd7703
4c13373a150b1e3bd12fdd9ad5c379a43e41c59ba5b6dd6982c79599839128bcbde30d7083a810d66604382f4d5aff24c22b504fdaab03f6743a7dc263d85651
Tags
Signatures
-
Ryuk
-
Deletes shadow copies
Description
Ransomware often targets backup files to inhibit system recovery.
Tags
TTPs
-
Modifies Installed Components in the registry
Tags
TTPs
-
Drops startup file
-
Reads user/profile data of web browsers
Description
Infostealers often target stored browser data, which can include saved credentials etc.
Tags
TTPs
-
Adds Run key to start application
Tags
TTPs
-
Enumerates connected drives
Description
Attempts to read the root path of hard drives other than the default C: drive.
TTPs
-
Drops file in System32 directory
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks
static1
Score
N/A
behavioral1
Score
10/10