ryuk

General

Target

ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0
Size

118KB
Sample

220220-bqtvasfcg3
MD5

347eeae717c9af712bef4146374ea162
SHA1

0b90db0136415072ade13f090dd99f8f3cb96404
SHA256

ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0
SHA512

cc66b1bccc65cf5a86d698d523a1217ec2e40d8fd005ab81891fef9d5008a044987fb9ec90e140c3dec650747c87a00aee3c7db8f332918e251eff95bc60c949

Score

10^/10

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = 'AahZSQ5kzw'; $torlink = 'http://shemngcwq3kbpigejjxj5toggdqrfqq6qagp556yxglfxe4qq4xuc4yd.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://shemngcwq3kbpigejjxj5toggdqrfqq6qagp556yxglfxe4qq4xuc4yd.onion

Targets

- Target
  
  ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0
- Size
  
  118KB
- MD5
  
  347eeae717c9af712bef4146374ea162
- SHA1
  
  0b90db0136415072ade13f090dd99f8f3cb96404
- SHA256
  
  ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0
- SHA512
  
  cc66b1bccc65cf5a86d698d523a1217ec2e40d8fd005ab81891fef9d5008a044987fb9ec90e140c3dec650747c87a00aee3c7db8f332918e251eff95bc60c949
Score

10^/10

ryuk discovery ransomware
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Modifies file permissions
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Modifies file permissions

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2