ryuk

General

Target

d4422c4f4a26aecad6e754dd172278305bacfa7d5ff285f6a74ed6c610307d59
Size

147KB
Sample

220220-bx4m3sgcgj
MD5

ef372e7d0490bce48f6c11fe9f6c96c2
SHA1

7ad646e6654e982d10c0bd6d9941476064800ebe
SHA256

d4422c4f4a26aecad6e754dd172278305bacfa7d5ff285f6a74ed6c610307d59
SHA512

a9b0b45ddd4089b73897592162c947f6e8e1dbce5ee5548294b3dde7f2b06aa23c8fb10be947282514fdacdc1eabdc252ef7c24c11f5b3d87212c35f49212f36

Score

10^/10

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note

Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation. More than a year ago, world experts recognized the impossibility of deciphering by any means except the original decoder. No decryption software is available in the public. Antiviruse companies, researchers, IT specialists, and no other persons cant help you encrypt the data. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT DELETE readme files. To confirm our honest intentions.Send 2 different random files and you will get it decrypted. It can be from different computers on your network to be sure that one key decrypts everything. 2 files we unlock for free To get info (decrypt your files) contact us at [email protected] or [email protected] BTC wallet: 1CbP3cgi1Bcjuz6g2Fwvk4tVhqohqAVpDQ Ryuk No system is safe

Emails

[email protected]

Wallets

1CbP3cgi1Bcjuz6g2Fwvk4tVhqohqAVpDQ

Targets

- Target
  
  d4422c4f4a26aecad6e754dd172278305bacfa7d5ff285f6a74ed6c610307d59
- Size
  
  147KB
- MD5
  
  ef372e7d0490bce48f6c11fe9f6c96c2
- SHA1
  
  7ad646e6654e982d10c0bd6d9941476064800ebe
- SHA256
  
  d4422c4f4a26aecad6e754dd172278305bacfa7d5ff285f6a74ed6c610307d59
- SHA512
  
  a9b0b45ddd4089b73897592162c947f6e8e1dbce5ee5548294b3dde7f2b06aa23c8fb10be947282514fdacdc1eabdc252ef7c24c11f5b3d87212c35f49212f36
Score

10^/10

ryuk persistence ransomware
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
behavioral1 behavioral2