ryuk

General

Target

58a0a5646669443e997f88d532219141ff6c9ca8d36cd449c34a1807be919a9d
Size

153KB
Sample

220220-hv5kxsahfq
MD5

91759691cfe41dd1a9dd07eaf9f48129
SHA1

37fd2b22f3a9c85cdbaaf4cbbe33333ecc8030c4
SHA256

58a0a5646669443e997f88d532219141ff6c9ca8d36cd449c34a1807be919a9d
SHA512

f19d0b358f318e243a648311b1cf7e9c162cf18880f667ba4daff3fd5696a17854a091791452ee9814b1e1e85d07f4b98da07d957b7f51b450692e85a6b5e3a6

Score

10^/10

ryuk ransomware

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note

Your network has been penetrated. All files on each network host have been encrypted with a strong algorithm. Backups were encrypted too. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. Only we have exclusive decryption software, suitable for your situation. More than a year ago, world experts recognized the impossibility of such encryption deciphering by any means except the original decoder. No decryption software is available in the public. Antivirus companies, researchers, IT specialists, and any other persons cannot help you to decipher the data. Decryption takes from ten minutes up to several hours. It is performed automatically and doesn't require from you any actions except decoder launching. DO NOT RESET OR SHUTDOWN SYSTEM � files may be damaged. DO NOT DELETE readme files. To confirm our honest intentions. Send 2 different random files and you will get them back decrypted. It can be from different computers on your network to be sure that one key decrypts everything. We will unlock 2 files for free. To get info (decrypt your files) contact us a [email protected] or [email protected] You will receive btc address for payment in the reply letter Ryuk No system is safe

Emails

[email protected]

Targets

- Target
  
  58a0a5646669443e997f88d532219141ff6c9ca8d36cd449c34a1807be919a9d
- Size
  
  153KB
- MD5
  
  91759691cfe41dd1a9dd07eaf9f48129
- SHA1
  
  37fd2b22f3a9c85cdbaaf4cbbe33333ecc8030c4
- SHA256
  
  58a0a5646669443e997f88d532219141ff6c9ca8d36cd449c34a1807be919a9d
- SHA512
  
  f19d0b358f318e243a648311b1cf7e9c162cf18880f667ba4daff3fd5696a17854a091791452ee9814b1e1e85d07f4b98da07d957b7f51b450692e85a6b5e3a6
Score

10^/10

ryuk ransomware
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Suspicious use of NtCreateProcessExOtherParentProcess
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Suspicious use of NtCreateProcessExOtherParentProcess

Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2