ryuk

General

Target

ec662c73279f4a3772e3e549b07bcd67803292981afae931df4b63d47f6ac2a9.exe.zip
Size

72KB
Sample

231002-pa4apaae31
MD5

fb717f755b084b93b92cde726c904604
SHA1

9bfc65a5d6653a73070e033ae03428cae7add578
SHA256

0f453b03bd85e87f357bf6e38a3d7f04c6351240e026c30e172cc748e6a49c14
SHA512

4c5942b45a0da3b56cba528f2b839af3b7df002328e2334841b36fe315ac905c0012dce285ba6ad7cb90a9a36fa54ac253def2d51e2d3a5a2e8c699363991dee
SSDEEP

1536:iaRm3UWDsqJaX2DUoe4TT093Y8AW3Tqo3gVUqHb8OHSpX:3m3UOZJaXro9T0hfTqo3gVUk8OypX

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

buricoume1976@protonmail.com balance of shadow universe Ryuk

Emails

buricoume1976@protonmail.com

Targets

- Target
  
  ec662c73279f4a3772e3e549b07bcd67803292981afae931df4b63d47f6ac2a9.exe
- Size
  
  76KB
- MD5
  
  1fff77fb1958e7f730bb4de627a24d57
- SHA1
  
  c3b071d324f095381bc604a46e1b8c5a89c68822
- SHA256
  
  ec662c73279f4a3772e3e549b07bcd67803292981afae931df4b63d47f6ac2a9
- SHA512
  
  53842ccf9a28f908f3e4ded42e5e925ce5c737c3b6458c6287f298cea948ecbac9ad18369f6b20665d6e0336e38b51d6aad43ec3bfbc155880b9361eef7acc61
- SSDEEP
  
  1536:+ukv6BlkOCJSlq3//M/NqKTmPCQASm/dKRYHQiY0aB6:yvqlkOCJSQ3XM4P4SaKRYwF0aB
Score

10^/10

ryuk ransomware upx
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

UPX packed file

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2