General

  • Target

    8141f47a1ee8453ac01daacb16cab2d18b37a9045edc5f20c9019d4327576704

  • Size

    378KB

  • Sample

    220124-e2gkwsbhc5

  • MD5

    1643b85e7f459c6ffe1e5ab9ebb53f93

  • SHA1

    3e42d07d89ef8d66b9a60664a53cbe7ae423c11c

  • SHA256

    8141f47a1ee8453ac01daacb16cab2d18b37a9045edc5f20c9019d4327576704

  • SHA512

    95a9a58bb84007dd1d8e37e6bf8cb2736003cc456951bfdaeaa24bc8696f0cc53e98225176f7de76a053a032e0c9d9b25e3cef57a3c289b2b932ac610b23b3d5

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note
Gentlemen! Your business is at serious risk. There is a significant hole in the security system of your company. We've easily penetrated your network. You should thank the Lord for being hacked by serious people not some stupid schoolboys or dangerous punks. They can damage all your important data just for fun. Now your files are crypted with the strongest millitary algorithms RSA4096 and AES-256. No one can help you to restore files without our special decoder. Photorec, RannohDecryptor etc. repair tools are useless and can destroy your files irreversibly. If you want to restore your files write to emails (contacts are at the bottom of the sheet) and attach 2-3 encrypted files (Less than 5 Mb each, non-archived and your files should not contain valuable information (Databases, backups, large excel sheets, etc.)). You will receive decrypted samples and our conditions how to get the decoder. Please don't forget to write the name of your company in the subject of your e-mail. You have to pay for decryption in Bitcoins. The final price depends on how fast you write to us. Every day of delay will cost you additional +0.5 BTC Nothing personal just business As soon as we get bitcoins you'll get all your decrypted data back. Moreover you will get instructions how to close the hole in security and how to avoid such problems in the future + we will recommend you special software that makes the most problems to hackers. Attention! One more time ! Do not rename encrypted files. Do not try to decrypt your data using third party software. P.S. Remember, we are not scammers. We don`t need your files and your information. But after 2 weeks all your files and keys will be deleted automatically. Just send a request immediately after infection. All data will be restored absolutely. Your warranty - decrypted samples. contact emails [email protected] or [email protected] BTC wallet: 1NQ42zc51stA4WAVkUK8uqFAjo1DbWv4Kz Ryuk No system is safe
Wallets

1NQ42zc51stA4WAVkUK8uqFAjo1DbWv4Kz

Targets

    • Target

      8141f47a1ee8453ac01daacb16cab2d18b37a9045edc5f20c9019d4327576704

    • Size

      378KB

    • MD5

      1643b85e7f459c6ffe1e5ab9ebb53f93

    • SHA1

      3e42d07d89ef8d66b9a60664a53cbe7ae423c11c

    • SHA256

      8141f47a1ee8453ac01daacb16cab2d18b37a9045edc5f20c9019d4327576704

    • SHA512

      95a9a58bb84007dd1d8e37e6bf8cb2736003cc456951bfdaeaa24bc8696f0cc53e98225176f7de76a053a032e0c9d9b25e3cef57a3c289b2b932ac610b23b3d5

    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks