Overview

overview

10

Static

static

379ff8def5...99.exe

windows7_x64

10

379ff8def5...99.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    379ff8def54e51a12c15d10479906d7e643c88cae9b829eeb7e1ea1e171b3a99

  • Size

    117KB

  • Sample

    220220-kdsadaaed8

  • MD5

    045eb328ff30b09cebd6fe3c031db7bc

  • SHA1

    b28cd818c54d7a4f5416728a8f8408e6c9c40bc2

  • SHA256

    379ff8def54e51a12c15d10479906d7e643c88cae9b829eeb7e1ea1e171b3a99

  • SHA512

    6f612366761abc5017dfdb6db985736f059fc21c8b6ab6816d379357cca7f9f1ff14690ddb71179e9771e58e0a5eb85d2765b58e8057666b497a7420658ae8e9

Score
10/10
ryukdiscoveryransomware

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note
contact balance of shadow universe Ryuk function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

Targets

    • Target

      379ff8def54e51a12c15d10479906d7e643c88cae9b829eeb7e1ea1e171b3a99

    • Size

      117KB

    • MD5

      045eb328ff30b09cebd6fe3c031db7bc

    • SHA1

      b28cd818c54d7a4f5416728a8f8408e6c9c40bc2

    • SHA256

      379ff8def54e51a12c15d10479906d7e643c88cae9b829eeb7e1ea1e171b3a99

    • SHA512

      6f612366761abc5017dfdb6db985736f059fc21c8b6ab6816d379357cca7f9f1ff14690ddb71179e9771e58e0a5eb85d2765b58e8057666b497a7420658ae8e9

    Score
    10/10
    ryukdiscoveryransomware

    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

      ransomwareryuk

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks