ryuk

General

Target

cde54dbada530a9c060259c6ad351b82513fb20074493acc913aa2a00a3dd50e
Size

121KB
Sample

220220-cb6qzsfef5
MD5

628da52a53fc3ff3e990f454928f4ea4
SHA1

214b361aa8de6df1785eb9039c01e046a323bfa0
SHA256

cde54dbada530a9c060259c6ad351b82513fb20074493acc913aa2a00a3dd50e
SHA512

81d4635fc11474cc3b9bd70d93989176266d66791c521d5af8bda8f89b8ee2ebfc4224947ce977e2997cc9ce143b67b7c1715672e2f5e7156f41c49c923f01a7

Score

10^/10

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = 'o0ZEpAZWbe'; $torlink = 'http://ddchw6p2kegymsyoqljqnsslebfh5t7e45s6m2pqhhn5mt4yb3rlazyd.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://ddchw6p2kegymsyoqljqnsslebfh5t7e45s6m2pqhhn5mt4yb3rlazyd.onion

Targets

- Target
  
  cde54dbada530a9c060259c6ad351b82513fb20074493acc913aa2a00a3dd50e
- Size
  
  121KB
- MD5
  
  628da52a53fc3ff3e990f454928f4ea4
- SHA1
  
  214b361aa8de6df1785eb9039c01e046a323bfa0
- SHA256
  
  cde54dbada530a9c060259c6ad351b82513fb20074493acc913aa2a00a3dd50e
- SHA512
  
  81d4635fc11474cc3b9bd70d93989176266d66791c521d5af8bda8f89b8ee2ebfc4224947ce977e2997cc9ce143b67b7c1715672e2f5e7156f41c49c923f01a7
Score

10^/10

ryuk discovery ransomware
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Modifies file permissions
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Modifies file permissions

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2