ryuk

General

Target

27661d53ec6d5e1938d85b9094c94ac51d0b82e849cffeaf261abb3ccde48e5e
Size

134KB
Sample

220220-k4wqgsagg6
MD5

b1ef5d407cdc3dab603735e862d0ba45
SHA1

656ebac8cb7fed5ca33b7fccf18aa0a3265eb0f8
SHA256

27661d53ec6d5e1938d85b9094c94ac51d0b82e849cffeaf261abb3ccde48e5e
SHA512

c728dbaae2e3bc8d057b2d679c401b2239f79ab5f398b246e358f5604215ecdf9bf598469f69d284fa3b7da1d0ccbef5c213aced739fa001d618c3ae35f0e096

Score

10^/10

Malware Config

Extracted

Path

C:\$Recycle.Bin\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = 'tKPGaxUEJ1'; $torlink = 'http://oc6mkf4efqrjp2ue6qp6vmz4ofyjmlo6dtqiklqb2q546bnqeu66tbyd.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://oc6mkf4efqrjp2ue6qp6vmz4ofyjmlo6dtqiklqb2q546bnqeu66tbyd.onion

Targets

- Target
  
  27661d53ec6d5e1938d85b9094c94ac51d0b82e849cffeaf261abb3ccde48e5e
- Size
  
  134KB
- MD5
  
  b1ef5d407cdc3dab603735e862d0ba45
- SHA1
  
  656ebac8cb7fed5ca33b7fccf18aa0a3265eb0f8
- SHA256
  
  27661d53ec6d5e1938d85b9094c94ac51d0b82e849cffeaf261abb3ccde48e5e
- SHA512
  
  c728dbaae2e3bc8d057b2d679c401b2239f79ab5f398b246e358f5604215ecdf9bf598469f69d284fa3b7da1d0ccbef5c213aced739fa001d618c3ae35f0e096
Score

10^/10

ryuk discovery ransomware
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Executes dropped EXE

Loads dropped DLL

Modifies file permissions

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2