ryuk

General

Target

87d24edd168572f28d262c9edc2b825ea628f86e39c2d1407e9fbc42685119de
Size

117KB
Sample

220220-fl152ahhfn
MD5

aaa963a1b4c71047d667f0c3d1760d44
SHA1

90ce48d945427822647242d42678fb6fb5b77d73
SHA256

87d24edd168572f28d262c9edc2b825ea628f86e39c2d1407e9fbc42685119de
SHA512

c3cfc8f91ac084ba4ed03e615bd0c55ef65dae3c0618dade3eccd1e2aada1edf30b6cd03e7240b2fce19b5f4f3071ee8c39ab57b0bd073d8049982eb9aea54c8

Score

10^/10

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = 'LkVKOksQ9pC'; $torlink = 'http://etnbhivw5fjqytbmvt2o6zle3avqn6rrugfc35kmcmedbbgqbxtknlqd.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://etnbhivw5fjqytbmvt2o6zle3avqn6rrugfc35kmcmedbbgqbxtknlqd.onion

Targets

- Target
  
  87d24edd168572f28d262c9edc2b825ea628f86e39c2d1407e9fbc42685119de
- Size
  
  117KB
- MD5
  
  aaa963a1b4c71047d667f0c3d1760d44
- SHA1
  
  90ce48d945427822647242d42678fb6fb5b77d73
- SHA256
  
  87d24edd168572f28d262c9edc2b825ea628f86e39c2d1407e9fbc42685119de
- SHA512
  
  c3cfc8f91ac084ba4ed03e615bd0c55ef65dae3c0618dade3eccd1e2aada1edf30b6cd03e7240b2fce19b5f4f3071ee8c39ab57b0bd073d8049982eb9aea54c8
Score

10^/10

ryuk discovery ransomware
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Modifies file permissions
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Modifies file permissions

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2