General

  • Target

    dc3e4b5f3090d65605a258aedc5efb370422742939d29bc527f00544415ea67d

  • Size

    171KB

  • Sample

    220220-bsn2tsgccj

  • MD5

    f15d9ff2e55afd39db70878776e3600a

  • SHA1

    5302667a32efa278f6e019787acfe0f405e0e74e

  • SHA256

    dc3e4b5f3090d65605a258aedc5efb370422742939d29bc527f00544415ea67d

  • SHA512

    58e723f590118de70c7208fa18cdbb2c632a4761f1f674c061f34e36fa4b2f1b7dd8e315e9ce0be989ed61d561dae0b82b95edf4a83982095db8582db183da5b

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note
Gentlemen! Your business is at serious risk. There is a significant hole in the security system of your company. We've easily penetrated your network. You should thank the Lord for being hacked by serious people not some stupid schoolboys or dangerous punks. They can damage all your important data just for fun. Now your files are crypted with the strongest millitary algorithms RSA4096 and AES-256. No one can help you to restore files without our special decoder. Photorec, RannohDecryptor etc. repair tools are useless and can destroy your files irreversibly. If you want to restore your files write to emails (contacts are at the bottom of the sheet) and attach 2-3 encrypted files (Less than 5 Mb each, non-archived and your files should not contain valuable information (Databases, backups, large excel sheets, etc.)). You will receive decrypted samples and our conditions how to get the decoder. Please don't forget to write the name of your company in the subject of your e-mail. You have to pay for decryption in Bitcoins. The final price depends on how fast you write to us. Every day of delay will cost you additional +0.5 BTC Nothing personal just business As soon as we get bitcoins you'll get all your decrypted data back. Moreover you will get instructions how to close the hole in security and how to avoid such problems in the future + we will recommend you special software that makes the most problems to hackers. Attention! One more time ! Do not rename encrypted files. Do not try to decrypt your data using third party software. P.S. Remember, we are not scammers. We don`t need your files and your information. But after 2 weeks all your files and keys will be deleted automatically. Just send a request immediately after infection. All data will be restored absolutely. Your warranty - decrypted samples. contact emails [email protected] or [email protected] BTC wallet: 17v2cu8RDXhAxufQ1YKiauBq6GGAZzfnFw Ryuk No system is safe
Wallets

17v2cu8RDXhAxufQ1YKiauBq6GGAZzfnFw

Targets

    • Target

      dc3e4b5f3090d65605a258aedc5efb370422742939d29bc527f00544415ea67d

    • Size

      171KB

    • MD5

      f15d9ff2e55afd39db70878776e3600a

    • SHA1

      5302667a32efa278f6e019787acfe0f405e0e74e

    • SHA256

      dc3e4b5f3090d65605a258aedc5efb370422742939d29bc527f00544415ea67d

    • SHA512

      58e723f590118de70c7208fa18cdbb2c632a4761f1f674c061f34e36fa4b2f1b7dd8e315e9ce0be989ed61d561dae0b82b95edf4a83982095db8582db183da5b

    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks