General

  • Target

    2d70e74d6f3d8d6146e8f0c70ae3e3d35b7964d95b295339e6c2914cc09afdc8

  • Size

    206KB

  • Sample

    220220-kvafwsbggp

  • MD5

    ed0179b4230a413fa1d9d042f6d413df

  • SHA1

    4d9e43a06730e174693e93f4ad6cb0a69ad05452

  • SHA256

    2d70e74d6f3d8d6146e8f0c70ae3e3d35b7964d95b295339e6c2914cc09afdc8

  • SHA512

    878ab62f10d7e7d0a4493141232ab65420e48868696d2226db49aa94bb6559365c8058cd5d99188f27a5a655e9a5e0fa6cae4cf04daa54e2e09c8ea67abeeb1b

Score
10/10

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note
Your network has been penetrated. All files on each network host have been encrypted with a strong algorithm. Backups were encrypted too. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. Only we have exclusive decryption software, suitable for your situation. More than a year ago, world experts recognized the impossibility of such encryption deciphering by any means except the original decoder. No decryption software is available in the public. Antivirus companies, researchers, IT specialists, and any other persons cannot help you to decipher the data. Decryption takes from ten minutes up to several hours. It is performed automatically and doesn't require from you any actions except decoder launching. DO NOT RESET OR SHUTDOWN SYSTEM � files may be damaged. DO NOT DELETE readme files. To confirm our honest intentions. Send 2 different random files and you will get them back decrypted. It can be from different computers on your network to be sure that one key decrypts everything. We will unlock 2 files for free. To get info (decrypt your files) contact us a MachowskiKapone@protonmail.com or ValenciaCarlito1994@protonmail.com You will receive btc address for payment in the reply letter Ryuk No system is safe
Emails

MachowskiKapone@protonmail.com

ValenciaCarlito1994@protonmail.com

Targets

    • Target

      2d70e74d6f3d8d6146e8f0c70ae3e3d35b7964d95b295339e6c2914cc09afdc8

    • Size

      206KB

    • MD5

      ed0179b4230a413fa1d9d042f6d413df

    • SHA1

      4d9e43a06730e174693e93f4ad6cb0a69ad05452

    • SHA256

      2d70e74d6f3d8d6146e8f0c70ae3e3d35b7964d95b295339e6c2914cc09afdc8

    • SHA512

      878ab62f10d7e7d0a4493141232ab65420e48868696d2226db49aa94bb6559365c8058cd5d99188f27a5a655e9a5e0fa6cae4cf04daa54e2e09c8ea67abeeb1b

    Score
    10/10
    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

    • Drops desktop.ini file(s)

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks