Overview

overview

10

Static

static

ddd788ff3c...a0.exe

windows7_x64

10

ddd788ff3c...a0.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0

  • Size

    118KB

  • Sample

    220220-bqtvasfcg3

  • MD5

    347eeae717c9af712bef4146374ea162

  • SHA1

    0b90db0136415072ade13f090dd99f8f3cb96404

  • SHA256

    ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0

  • SHA512

    cc66b1bccc65cf5a86d698d523a1217ec2e40d8fd005ab81891fef9d5008a044987fb9ec90e140c3dec650747c87a00aee3c7db8f332918e251eff95bc60c949

Score
10/10
ryukdiscoveryransomware

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note
contact balance of shadow universe Ryuk $password = 'AahZSQ5kzw'; $torlink = 'http://shemngcwq3kbpigejjxj5toggdqrfqq6qagp556yxglfxe4qq4xuc4yd.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};
URLs

http://shemngcwq3kbpigejjxj5toggdqrfqq6qagp556yxglfxe4qq4xuc4yd.onion

Targets

    • Target

      ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0

    • Size

      118KB

    • MD5

      347eeae717c9af712bef4146374ea162

    • SHA1

      0b90db0136415072ade13f090dd99f8f3cb96404

    • SHA256

      ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0

    • SHA512

      cc66b1bccc65cf5a86d698d523a1217ec2e40d8fd005ab81891fef9d5008a044987fb9ec90e140c3dec650747c87a00aee3c7db8f332918e251eff95bc60c949

    Score
    10/10
    ryukdiscoveryransomware

    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

      ransomwareryuk

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks