ryuk

General

Target

6bec64452076bf8a5facfaafaaa89d76f6695eb0d71bd24b01b1d697bbf86f20
Size

184KB
Sample

220220-gw7agahdh9
MD5

e04ed93986095d0b9def687de63a682b
SHA1

ba09fe2167f7b75d659f0c8723f44b875a23a91b
SHA256

6bec64452076bf8a5facfaafaaa89d76f6695eb0d71bd24b01b1d697bbf86f20
SHA512

14dab6fe8654b2e2ffb8ddeb39f7cd6b0d9ffff8665eff59f8024f4a0cd56110075550164757d4f8bb25de1902062bf9e89e15057bd2b716d636c244714df420

Score

10^/10

ryuk ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> [email protected] </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html��

Emails

[email protected]

Targets

- Target
  
  6bec64452076bf8a5facfaafaaa89d76f6695eb0d71bd24b01b1d697bbf86f20
- Size
  
  184KB
- MD5
  
  e04ed93986095d0b9def687de63a682b
- SHA1
  
  ba09fe2167f7b75d659f0c8723f44b875a23a91b
- SHA256
  
  6bec64452076bf8a5facfaafaaa89d76f6695eb0d71bd24b01b1d697bbf86f20
- SHA512
  
  14dab6fe8654b2e2ffb8ddeb39f7cd6b0d9ffff8665eff59f8024f4a0cd56110075550164757d4f8bb25de1902062bf9e89e15057bd2b716d636c244714df420
Score

10^/10

ryuk ransomware
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2