General

  • Target

    53cfffafc3f552b70e336dfe56d48ac9b78f62ced2992297828948f149f01f14

  • Size

    150KB

  • Sample

    220220-h5w2jaaab6

  • MD5

    d6a8a47358a0be9cd88e3909023a26b7

  • SHA1

    a309b709036cf394afa39b9dd8ae90dff2f00cd2

  • SHA256

    53cfffafc3f552b70e336dfe56d48ac9b78f62ced2992297828948f149f01f14

  • SHA512

    1913bd3996729a5f5912c171b80159529b688e4c19283740f28eba5859bdb83f7a4612494cb56396993f5795045a768b7e820deedd166c1e8303210c84ee80f4

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note
Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation. More than a year ago, world experts recognized the impossibility of deciphering by any means except the original decoder. No decryption software is available in the public. Antiviruse companies, researchers, IT specialists, and no other persons cant help you encrypt the data. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT DELETE readme files. To confirm our honest intentions.Send 2 different random files and you will get it decrypted. It can be from different computers on your network to be sure that one key decrypts everything. 2 files we unlock for free To get info (decrypt your files) contact us at [email protected] or [email protected] BTC wallet: 1C8n86EEttnDjNKM9Tjm7QNVgwGBncQhDs Ryuk No system is safe
Wallets

1C8n86EEttnDjNKM9Tjm7QNVgwGBncQhDs

Targets

    • Target

      53cfffafc3f552b70e336dfe56d48ac9b78f62ced2992297828948f149f01f14

    • Size

      150KB

    • MD5

      d6a8a47358a0be9cd88e3909023a26b7

    • SHA1

      a309b709036cf394afa39b9dd8ae90dff2f00cd2

    • SHA256

      53cfffafc3f552b70e336dfe56d48ac9b78f62ced2992297828948f149f01f14

    • SHA512

      1913bd3996729a5f5912c171b80159529b688e4c19283740f28eba5859bdb83f7a4612494cb56396993f5795045a768b7e820deedd166c1e8303210c84ee80f4

    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks