Overview

overview

10

Static

static

8

27661d53ec...5e.dll

windows7_x64

10

27661d53ec...5e.dll

windows10-2004_x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    27661d53ec6d5e1938d85b9094c94ac51d0b82e849cffeaf261abb3ccde48e5e

  • Size

    134KB

  • Sample

    220220-k4wqgsagg6

  • MD5

    b1ef5d407cdc3dab603735e862d0ba45

  • SHA1

    656ebac8cb7fed5ca33b7fccf18aa0a3265eb0f8

  • SHA256

    27661d53ec6d5e1938d85b9094c94ac51d0b82e849cffeaf261abb3ccde48e5e

  • SHA512

    c728dbaae2e3bc8d057b2d679c401b2239f79ab5f398b246e358f5604215ecdf9bf598469f69d284fa3b7da1d0ccbef5c213aced739fa001d618c3ae35f0e096

Score
10/10
ryukdavediscoveryransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\RyukReadMe.html

Family

ryuk

Ransom Note
contact balance of shadow universe Ryuk $password = 'tKPGaxUEJ1'; $torlink = 'http://oc6mkf4efqrjp2ue6qp6vmz4ofyjmlo6dtqiklqb2q546bnqeu66tbyd.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};
URLs

http://oc6mkf4efqrjp2ue6qp6vmz4ofyjmlo6dtqiklqb2q546bnqeu66tbyd.onion

Targets

    • Target

      27661d53ec6d5e1938d85b9094c94ac51d0b82e849cffeaf261abb3ccde48e5e

    • Size

      134KB

    • MD5

      b1ef5d407cdc3dab603735e862d0ba45

    • SHA1

      656ebac8cb7fed5ca33b7fccf18aa0a3265eb0f8

    • SHA256

      27661d53ec6d5e1938d85b9094c94ac51d0b82e849cffeaf261abb3ccde48e5e

    • SHA512

      c728dbaae2e3bc8d057b2d679c401b2239f79ab5f398b246e358f5604215ecdf9bf598469f69d284fa3b7da1d0ccbef5c213aced739fa001d618c3ae35f0e096

    Score
    10/10
    ryukdiscoveryransomware

    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

      ransomwareryuk

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1
T1222

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks