General

  • Target

    cf2e3265c9a05b2616ebc53a6f9ed7e8fc188ba15834295bb16f68c48de65b7d

  • Size

    209KB

  • Sample

    220220-b9cecsfed4

  • MD5

    a48d9d97ed4698432823d5fbc4426e35

  • SHA1

    77b6c5b3c3890ad324743367e37da8a35882fde2

  • SHA256

    cf2e3265c9a05b2616ebc53a6f9ed7e8fc188ba15834295bb16f68c48de65b7d

  • SHA512

    1baadbbb701db4f75f40adae0da76ccd9ee4b20c82697cfaef3e34f20b9142f1ff90edbc96984c0de8e99baec63ec378730fa4fd0765b931cb4242bd79862521

Score
10/10

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note
Special warning for system administrators, network administrators and third parties: Do not try to solve this problem by yourselves! Don't change file extensions! It can be dangerous for the encrypted information! Your network has been penetrated. All files on each network host have been encrypted with a strong algorithm. Backups were encrypted too. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. Decryption takes from ten minutes up to several hours. It is performed automatically and doesn't require from you any actions except decoder launching. DO NOT RESET OR SHUTDOWN SYSTEM � files may be damaged. DO NOT DELETE readme files.Your system administrators are trying to solve problem by simple file extension changing. This actions seriously increase the time needed to recover your company's PCs and network servers! To confirm our honest intentions. Send 2 different random files and you will get them back decrypted. It can be from different computers on your network to be sure that one key decrypts everything. We will unlock 2 files for free. To get info (decrypt your files) contact us at [email protected] or [email protected] You will receive btc address for payment in the reply letter Ryuk No system is safe

Targets

    • Target

      cf2e3265c9a05b2616ebc53a6f9ed7e8fc188ba15834295bb16f68c48de65b7d

    • Size

      209KB

    • MD5

      a48d9d97ed4698432823d5fbc4426e35

    • SHA1

      77b6c5b3c3890ad324743367e37da8a35882fde2

    • SHA256

      cf2e3265c9a05b2616ebc53a6f9ed7e8fc188ba15834295bb16f68c48de65b7d

    • SHA512

      1baadbbb701db4f75f40adae0da76ccd9ee4b20c82697cfaef3e34f20b9142f1ff90edbc96984c0de8e99baec63ec378730fa4fd0765b931cb4242bd79862521

    Score
    10/10
    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

    • Drops desktop.ini file(s)

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks