ryuk

General

Target

4992a629599d25933b55fee0b69198e80ecdcb3727a0b11b3d2891e6cd5da555
Size

123KB
Sample

220220-jj4d6aabg2
MD5

55f9f395702221ef4943ad778f3db103
SHA1

27a7e4a5a7035f31977bbc736547d904bd6569cf
SHA256

4992a629599d25933b55fee0b69198e80ecdcb3727a0b11b3d2891e6cd5da555
SHA512

7e0cf5cf151f6cfd4eca5d6d190e7610c202ab6ea61973f49332c1206c09c2980ac99b395deeee6bc59ee443b8f2872b4e99510011372cdc2f5a648efbfb436d

Score

10^/10

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note

Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted or deleted or backup disks were formatted. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation No decryption software is available in the public. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. This may lead to the impossibility of recovery of the certain files. To get info (decrypt your files) contact us at [email protected] or [email protected] BTC wallet: 1CN2iQbBikFK9jM34Nb3WLx5DCenQLnbXp Ryuk

Emails

[email protected]

Wallets

1CN2iQbBikFK9jM34Nb3WLx5DCenQLnbXp

Targets

- Target
  
  4992a629599d25933b55fee0b69198e80ecdcb3727a0b11b3d2891e6cd5da555
- Size
  
  123KB
- MD5
  
  55f9f395702221ef4943ad778f3db103
- SHA1
  
  27a7e4a5a7035f31977bbc736547d904bd6569cf
- SHA256
  
  4992a629599d25933b55fee0b69198e80ecdcb3727a0b11b3d2891e6cd5da555
- SHA512
  
  7e0cf5cf151f6cfd4eca5d6d190e7610c202ab6ea61973f49332c1206c09c2980ac99b395deeee6bc59ee443b8f2872b4e99510011372cdc2f5a648efbfb436d
Score

10^/10

ryuk persistence ransomware
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
behavioral1 behavioral2