ryuk

General

Target

b65427323350e8f21e50081ecf03987e
Size

212KB
Sample

231220-qcpqraddal
MD5

b65427323350e8f21e50081ecf03987e
SHA1

07be7f355a4d6383880e23bf83eee21d8897715b
SHA256

3d77377ed8f959598d211aaab147bc5b7d4e33fd3b24492b5d3b911ff197e17a
SHA512

51ba46989c360bb7c5d617124b12ecdd46e6f85b7316f6179d7b7c772c7233101273cd4732eba0b30198cf8ef81c717d465e35462417616342c352cda654729a
SSDEEP

6144:xC6fd/H2abLXuSEKpBdhyEmeu4Af3RA2:xCKduabs8BdhUedAf3R

Score

10^/10

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = 'ky0SRjh'; $torlink = 'http://rk2zzyh63g5avvii4irkhymha3irblchdfj7prk6zwy23f6kahidkpqd.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://rk2zzyh63g5avvii4irkhymha3irblchdfj7prk6zwy23f6kahidkpqd.onion

Targets

- Target
  
  b65427323350e8f21e50081ecf03987e
- Size
  
  212KB
- MD5
  
  b65427323350e8f21e50081ecf03987e
- SHA1
  
  07be7f355a4d6383880e23bf83eee21d8897715b
- SHA256
  
  3d77377ed8f959598d211aaab147bc5b7d4e33fd3b24492b5d3b911ff197e17a
- SHA512
  
  51ba46989c360bb7c5d617124b12ecdd46e6f85b7316f6179d7b7c772c7233101273cd4732eba0b30198cf8ef81c717d465e35462417616342c352cda654729a
- SSDEEP
  
  6144:xC6fd/H2abLXuSEKpBdhyEmeu4Af3RA2:xCKduabs8BdhUedAf3R
Score

10^/10

discovery ryuk ransomware
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Renames multiple (6690) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2