ryuk

General

Target

0c51ca0477a2a23eede0757f49f07891c15fe977bde5f293d05ddbce43c9531e
Size

386KB
Sample

220219-j9dleshha3
MD5

7bd387176c3b768d4c4c5522072f3753
SHA1

0ec05c75a232a16babe9e7d77d1f9165afb1aac4
SHA256

0c51ca0477a2a23eede0757f49f07891c15fe977bde5f293d05ddbce43c9531e
SHA512

dd9584273adbbbf9f6c8d951bb00b2930a89dd3db2cacdf8f24c7ce57b31e62469da62219c8fc0d3b366add12b3ca32b82a3e74e1463293b1159fd188da46024

Score

10^/10

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note

Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted or deleted or backup disks were formatted. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation No decryption software is available in the public. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. This may lead to the impossibility of recovery of the certain files. To get info (decrypt your files) contact us at [email protected] or [email protected] BTC wallet: 14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk Ryuk No system is safe

Emails

[email protected]

Wallets

14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk

Targets

- Target
  
  0c51ca0477a2a23eede0757f49f07891c15fe977bde5f293d05ddbce43c9531e
- Size
  
  386KB
- MD5
  
  7bd387176c3b768d4c4c5522072f3753
- SHA1
  
  0ec05c75a232a16babe9e7d77d1f9165afb1aac4
- SHA256
  
  0c51ca0477a2a23eede0757f49f07891c15fe977bde5f293d05ddbce43c9531e
- SHA512
  
  dd9584273adbbbf9f6c8d951bb00b2930a89dd3db2cacdf8f24c7ce57b31e62469da62219c8fc0d3b366add12b3ca32b82a3e74e1463293b1159fd188da46024
Score

10^/10

ryuk persistence ransomware
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2