ryuk

General

Target

c7f8289950b0d8aa97dceadf2a98aef51886710d56a5283b889c9ad191531028
Size

130KB
Sample

220220-cm2amsfff4
MD5

1e2b8973130672a1e739b035d30155b0
SHA1

b4f098806ac9060f0f4dd3d63e8d831c69be6c81
SHA256

c7f8289950b0d8aa97dceadf2a98aef51886710d56a5283b889c9ad191531028
SHA512

a4be4accd1f5a7ab4131b477f61565822f545cff1c89e6167de4f07fa7bb1a8204c87c7ad7a40c83ed54161f5f4e6853196bb843949222384efd561692e2c4be

Score

10^/10

Malware Config

Extracted

Path

C:\$Recycle.Bin\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = 'BVb1qR2'; $torlink = 'http://oc6mkf4efqrjp2ue6qp6vmz4ofyjmlo6dtqiklqb2q546bnqeu66tbyd.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://oc6mkf4efqrjp2ue6qp6vmz4ofyjmlo6dtqiklqb2q546bnqeu66tbyd.onion

Targets

- Target
  
  c7f8289950b0d8aa97dceadf2a98aef51886710d56a5283b889c9ad191531028
- Size
  
  130KB
- MD5
  
  1e2b8973130672a1e739b035d30155b0
- SHA1
  
  b4f098806ac9060f0f4dd3d63e8d831c69be6c81
- SHA256
  
  c7f8289950b0d8aa97dceadf2a98aef51886710d56a5283b889c9ad191531028
- SHA512
  
  a4be4accd1f5a7ab4131b477f61565822f545cff1c89e6167de4f07fa7bb1a8204c87c7ad7a40c83ed54161f5f4e6853196bb843949222384efd561692e2c4be
Score

10^/10

ryuk discovery ransomware
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Executes dropped EXE

Loads dropped DLL

Modifies file permissions

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2