ryuk

General

Target

2024-04-13_7f193964270dc3d207e4413890c95ab2_ryuk
Size

170KB
Sample

240413-egxflseb7y
MD5

7f193964270dc3d207e4413890c95ab2
SHA1

e3b1b6adf8292e91234a455397d6496b5d92e322
SHA256

29824133432b929766e8287ad658b75ebfef08d62341c0bb338f239c6f114932
SHA512

16210a0ee45b1ea20921ea967e44ad569427960c8299840398c8024c7ef88d18ff4aaf18a6331bbc620992e6ae77c221a72381d136b9f4b1070d4cb788e410d4
SSDEEP

3072:2HeriftL/WSo1vDb53j/8WGUzaqVh4LI8zQpni:2+rA/WSo1rl3ALrlHQpni

Score

10^/10

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note

Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted or deleted or backup disks were formatted. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation No decryption software is available in the public. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. This may lead to the impossibility of recovery of the certain files. To get info (decrypt your files) contact us at [email protected] or [email protected] BTC wallet: 14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk Ryuk No system is safe

Emails

[email protected]

Wallets

14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk

Targets

- Target
  
  2024-04-13_7f193964270dc3d207e4413890c95ab2_ryuk
- Size
  
  170KB
- MD5
  
  7f193964270dc3d207e4413890c95ab2
- SHA1
  
  e3b1b6adf8292e91234a455397d6496b5d92e322
- SHA256
  
  29824133432b929766e8287ad658b75ebfef08d62341c0bb338f239c6f114932
- SHA512
  
  16210a0ee45b1ea20921ea967e44ad569427960c8299840398c8024c7ef88d18ff4aaf18a6331bbc620992e6ae77c221a72381d136b9f4b1070d4cb788e410d4
- SSDEEP
  
  3072:2HeriftL/WSo1vDb53j/8WGUzaqVh4LI8zQpni:2+rA/WSo1rl3ALrlHQpni
Score

10^/10

ryuk persistence ransomware
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Detects command variations typically used by ransomware
- Detects executables containing many references to VEEAM. Observed in ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
behavioral1 behavioral2