ryuk

General

Target

7b91993341995065df2a78819d0984fa7760c4bac8d50ad62d3150eeed2c3f8b
Size

71KB
Sample

220220-f5agesaben
MD5

a2ea3c46d0a15c29fcd2000b1da24657
SHA1

8682038788db406bc5328757541b9da69d9304ad
SHA256

7b91993341995065df2a78819d0984fa7760c4bac8d50ad62d3150eeed2c3f8b
SHA512

1f7d73101aed9d3c5b2e739944e4469957cb4a105f76e90ed4d77662e78e596af24562faf30e33ec7914563044268e86053ff215c03b787c0870a3ade1bf3b5e

Score

10^/10

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note

Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted or deleted or backup disks were formatted. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation No decryption software is available in the public. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. This may lead to the impossibility of recovery of the certain files. To get info (decrypt your files) contact us at [email protected] or [email protected] BTC wallet: 14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk Ryuk No system is safe

Emails

[email protected]

Wallets

14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk

Targets

- Target
  
  7b91993341995065df2a78819d0984fa7760c4bac8d50ad62d3150eeed2c3f8b
- Size
  
  71KB
- MD5
  
  a2ea3c46d0a15c29fcd2000b1da24657
- SHA1
  
  8682038788db406bc5328757541b9da69d9304ad
- SHA256
  
  7b91993341995065df2a78819d0984fa7760c4bac8d50ad62d3150eeed2c3f8b
- SHA512
  
  1f7d73101aed9d3c5b2e739944e4469957cb4a105f76e90ed4d77662e78e596af24562faf30e33ec7914563044268e86053ff215c03b787c0870a3ade1bf3b5e
Score

10^/10

ryuk persistence ransomware upx
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
behavioral1 behavioral2