ryuk

General

Target

1efee516f6e8c5004de0ac50e94330fd1e4ffbf11412130dc7ecf7833062dd50
Size

168KB
Sample

220220-lhck6abab8
MD5

a66f22dfd411a7481b52511ea944209a
SHA1

e723b9d32b367c127d181e122ec53e0d528b4954
SHA256

1efee516f6e8c5004de0ac50e94330fd1e4ffbf11412130dc7ecf7833062dd50
SHA512

65089f73b85d7f14b9276dac0c5653f00c3e1d958ffccda2a980201ee5141055faadbc7795d7aef6848182904112feb0af6727697e17313f082c32a189f77dd8

Score

10^/10

ryuk ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> [email protected] </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html��

Emails

[email protected]

Targets

- Target
  
  1efee516f6e8c5004de0ac50e94330fd1e4ffbf11412130dc7ecf7833062dd50
- Size
  
  168KB
- MD5
  
  a66f22dfd411a7481b52511ea944209a
- SHA1
  
  e723b9d32b367c127d181e122ec53e0d528b4954
- SHA256
  
  1efee516f6e8c5004de0ac50e94330fd1e4ffbf11412130dc7ecf7833062dd50
- SHA512
  
  65089f73b85d7f14b9276dac0c5653f00c3e1d958ffccda2a980201ee5141055faadbc7795d7aef6848182904112feb0af6727697e17313f082c32a189f77dd8
Score

10^/10

ryuk ransomware
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2