Overview

overview

10

Static

static

529cefc842...67.exe

windows7_x64

10

529cefc842...67.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    529cefc842349f283599931e53f5b97bd6083e986e8a8e16f8aca370d5390967

  • Size

    171KB

  • Sample

    220220-h7h8fsaad3

  • MD5

    bb0929ec43b8eea61ab777ecd9f44541

  • SHA1

    f1fd81590a93b8895884f2bafcd8d48de1627fdb

  • SHA256

    529cefc842349f283599931e53f5b97bd6083e986e8a8e16f8aca370d5390967

  • SHA512

    09dadd375f5faebeba2761dc7cfc6cc7cdb52ecce3798044a88c5bc165d2e6b3c3810a7ff62641363e613a5c9f512f0be5d0bbdac83f68838feaac26b78680a0

Score
10/10
ryukransomware

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note
Special warning for system administrators, network administrators and third parties: Do not try to solve this problem by yourselves! Don't change file extensions! It can be dangerous for the encrypted information! Your network has been penetrated. All files on each network host have been encrypted with a strong algorithm. Backups were encrypted too. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. Decryption takes from ten minutes up to several hours. It is performed automatically and doesn't require from you any actions except decoder launching. DO NOT RESET OR SHUTDOWN SYSTEM � files may be damaged. DO NOT DELETE readme files.Your system administrators are trying to solve problem by simple file extension changing. This actions seriously increase the time needed to recover your company's PCs and network servers! To confirm our honest intentions. Send 2 different random files and you will get them back decrypted. It can be from different computers on your network to be sure that one key decrypts everything. We will unlock 2 files for free. To get info (decrypt your files) contact us at [email protected] or [email protected] You will receive btc address for payment in the reply letter Ryuk No system is safe

Targets

    • Target

      529cefc842349f283599931e53f5b97bd6083e986e8a8e16f8aca370d5390967

    • Size

      171KB

    • MD5

      bb0929ec43b8eea61ab777ecd9f44541

    • SHA1

      f1fd81590a93b8895884f2bafcd8d48de1627fdb

    • SHA256

      529cefc842349f283599931e53f5b97bd6083e986e8a8e16f8aca370d5390967

    • SHA512

      09dadd375f5faebeba2761dc7cfc6cc7cdb52ecce3798044a88c5bc165d2e6b3c3810a7ff62641363e613a5c9f512f0be5d0bbdac83f68838feaac26b78680a0

    Score
    10/10
    ryukransomware

    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

      ransomwareryuk

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks