ryuk

General

Target

Sample_5d283d656ea1e5165f2c7b8c.exe
Size

205KB
Sample

230912-jda6esea81
MD5

881db1945686533f06f6626da444a7b5
SHA1

776fff17a531a374d13a9e267db764e3463a4cfc
SHA256

c85fec6ed44bdfd54c5f37190ffad38919640064ce718045e228dca65f74ec7b
SHA512

639d684ab5a15a23355577d0c0e6cab29fe66596af5c5644a4fb258c3f65324c94f4c5fc4f76c7b7ac2ff0f15ffc69e98c279f59e8897e3db4e3ffaee2e96af6
SSDEEP

3072:30imLeE+6Kiei4VrJo6lxPJUVjIMaNhUv:LE+6Kt53oExlNh

Score

10^/10

ryuk ransomware

Malware Config

Extracted

Path

C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\Profiles\RyukReadMe.html

Family

ryuk

Ransom Note

sosareli1979@protonmail.com ovdategdi1985@protonmail.com balance of shadow universe Ryuk

Emails

sosareli1979@protonmail.com

ovdategdi1985@protonmail.com

Targets

- Target
  
  Sample_5d283d656ea1e5165f2c7b8c.exe
- Size
  
  205KB
- MD5
  
  881db1945686533f06f6626da444a7b5
- SHA1
  
  776fff17a531a374d13a9e267db764e3463a4cfc
- SHA256
  
  c85fec6ed44bdfd54c5f37190ffad38919640064ce718045e228dca65f74ec7b
- SHA512
  
  639d684ab5a15a23355577d0c0e6cab29fe66596af5c5644a4fb258c3f65324c94f4c5fc4f76c7b7ac2ff0f15ffc69e98c279f59e8897e3db4e3ffaee2e96af6
- SSDEEP
  
  3072:30imLeE+6Kiei4VrJo6lxPJUVjIMaNhUv:LE+6Kt53oExlNh
Score

10^/10

ryuk ransomware
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Checks computer location settings

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2