ryuk

General

Target

53e5bfb0be32202aaeff40f267454abdd12e58e50d295988ad111718ad886a74
Size

170KB
Sample

220220-h5rf2saab5
MD5

cbc4a644b35edb3610d76068a9bd5592
SHA1

91e6feadc8900505902c626737d6a98f6244cfd6
SHA256

53e5bfb0be32202aaeff40f267454abdd12e58e50d295988ad111718ad886a74
SHA512

85ad10e59645d50728bb9145553fa87c6e105a8555aba0d20b349223099109c4d3d4dde56c2cee2d71e5208372dae7db96b0dd4cb12389e767f132305ba85291

Score

10^/10

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note

Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted or deleted or backup disks were formatted. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation No decryption software is available in the public. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. This may lead to the impossibility of recovery of the certain files. To get info (decrypt your files) contact us at WayneEvenson@protonmail.com or WayneEvenson@tutanota.com BTC wallet: 14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk Ryuk No system is safe

Emails

WayneEvenson@protonmail.com

WayneEvenson@tutanota.com

Wallets

14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk

Targets

- Target
  
  53e5bfb0be32202aaeff40f267454abdd12e58e50d295988ad111718ad886a74
- Size
  
  170KB
- MD5
  
  cbc4a644b35edb3610d76068a9bd5592
- SHA1
  
  91e6feadc8900505902c626737d6a98f6244cfd6
- SHA256
  
  53e5bfb0be32202aaeff40f267454abdd12e58e50d295988ad111718ad886a74
- SHA512
  
  85ad10e59645d50728bb9145553fa87c6e105a8555aba0d20b349223099109c4d3d4dde56c2cee2d71e5208372dae7db96b0dd4cb12389e767f132305ba85291
Score

10^/10

ryuk persistence ransomware
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
behavioral1 behavioral2