Extracted

• • Target

    ryuk.bin

  • Size

    548KB

  • MD5

    987336d00fdbec3bcdb95b078f7de46f

  • SHA1

    8bbded5710280f055bf53f9e4f6c5abb596f7899

  • SHA256

    a9643eb83d509ad4eac20a2a89d8571f8d781979ad078e89f5b75b4bcb16f65e

  • SHA512

    39edeaa6ec301af43886748b588dd554c5f06d9dabbaf9aa6595a216111fe2923ba8c48e177f0a9ff2b865923d1051005299946765fc303c409419d7eca6e2a3

  • SSDEEP

    12288:bma40rTiKNAIRhOnloZq7St7uIUr086ah2I/0xI8QTPCXOY1LEfVUF:bH4URP0lVEO0xI8CIOIIfK

  Score

  10^/10

  ryukdiscoverypersistenceransomware

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Renames multiple (5421) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence
  behavioral1