ryuk

General

Target

ff90b93b8b79c8fb881b489263d53dd69dd5b98211507a2956885d7c71e086a2
Size

114KB
Sample

220219-3vsataefb6
MD5

a9b7b3af239126f1ec4e1549076b6f6a
SHA1

d26ae4e7aac4529370583bb9e401152746d88a41
SHA256

ff90b93b8b79c8fb881b489263d53dd69dd5b98211507a2956885d7c71e086a2
SHA512

572587a2a5ef1fb275c9059e32191399780311dac2d064a211303f87a768c1acdc903a8d966723ff9b2375ec31a985a55f3623a2631d4dcf83d564e6eb7280ce

Score

10^/10

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note

<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html��

Emails

[email protected]

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note

[email protected] balance of shadow universe Ryuk

Emails

[email protected]

Targets

- Target
  
  ff90b93b8b79c8fb881b489263d53dd69dd5b98211507a2956885d7c71e086a2
- Size
  
  114KB
- MD5
  
  a9b7b3af239126f1ec4e1549076b6f6a
- SHA1
  
  d26ae4e7aac4529370583bb9e401152746d88a41
- SHA256
  
  ff90b93b8b79c8fb881b489263d53dd69dd5b98211507a2956885d7c71e086a2
- SHA512
  
  572587a2a5ef1fb275c9059e32191399780311dac2d064a211303f87a768c1acdc903a8d966723ff9b2375ec31a985a55f3623a2631d4dcf83d564e6eb7280ce
Score

10^/10

ryuk discovery persistence ransomware
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
behavioral1 behavioral2