ryuk

General

Target

e5ceb42928a16190aeb1a9893c89e808a756a30193ccd542f63c726da7d9fa5c
Size

214KB
Sample

220220-bcferagafq
MD5

4d3454c85d85856674bb6e835f139649
SHA1

a8d64f6dddff26b423793e08994a6ee19077c1f7
SHA256

e5ceb42928a16190aeb1a9893c89e808a756a30193ccd542f63c726da7d9fa5c
SHA512

e713ee2c5fe12dfa27e8294ce1a6415221cccead720dd5163d6ccb399518a810ad567db39023a763ce39a8b861b39400f1faa56d8398c7c64fa7a5fdc2010c6c

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html��

Emails

[email protected]

Extracted

Path

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

[email protected] balance of shadow universe Ryuk

Emails

[email protected]

Targets

- Target
  
  e5ceb42928a16190aeb1a9893c89e808a756a30193ccd542f63c726da7d9fa5c
- Size
  
  214KB
- MD5
  
  4d3454c85d85856674bb6e835f139649
- SHA1
  
  a8d64f6dddff26b423793e08994a6ee19077c1f7
- SHA256
  
  e5ceb42928a16190aeb1a9893c89e808a756a30193ccd542f63c726da7d9fa5c
- SHA512
  
  e713ee2c5fe12dfa27e8294ce1a6415221cccead720dd5163d6ccb399518a810ad567db39023a763ce39a8b861b39400f1faa56d8398c7c64fa7a5fdc2010c6c
Score

10^/10

ryuk discovery persistence ransomware
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Suspicious use of NtCreateProcessExOtherParentProcess
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
behavioral1 behavioral2