ryuk

General

Target

JaffaCakes118_6d2518918e5c6e5738338e1acebbdac572308585f39a3c61f82825c539e9c5e2
Size

64KB
Sample

241225-18hx7azqbn
MD5

46740b9ab754c468a9fd1a2be496a352
SHA1

5e786984224339eb7d140677bf2e2eedc97c66c5
SHA256

6d2518918e5c6e5738338e1acebbdac572308585f39a3c61f82825c539e9c5e2
SHA512

5bbda54e2baee4abe9ed52c1f559d9c808dfee02b95db884af4a435e4244b2bc1b6b8810ccc1b1241ff76a90f2c3e752b3dd5d603e11e83a704a309351fe86d6
SSDEEP

768:P6EYGI+sojmkD1xe8KiDBjW4iU8HlOWauZ/p5ZHktwOZ6zQbHyEFniwNpyCq4LYb:C/3MK8pBjWFU/W3ZErbMI3q4+Yq6KTKg

Score

10^/10

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = 'BVb1qR2'; $torlink = 'http://oc6mkf4efqrjp2ue6qp6vmz4ofyjmlo6dtqiklqb2q546bnqeu66tbyd.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://oc6mkf4efqrjp2ue6qp6vmz4ofyjmlo6dtqiklqb2q546bnqeu66tbyd.onion

Targets

- Target
  
  9eb7abf2228ad28d8b7f571e0495d4a35da40607f04355307077975e271553b8
- Size
  
  119KB
- MD5
  
  c68395e474088d5339972e2bf5a30f3c
- SHA1
  
  502e42240969399c09337ecc7b5ca8fc1ba4baf3
- SHA256
  
  9eb7abf2228ad28d8b7f571e0495d4a35da40607f04355307077975e271553b8
- SHA512
  
  5320fe8144071dde940ebd0285e6fcf573d36c28ea51fca3b5aecc49bfe5ffcf25d1afbd294e0d0b565a3a621d5ea189b075d868bbef521f2e1fe6702e8be75a
- SSDEEP
  
  1536:j/t3fhrg5rw0lQa2+T37us7RidSkPq9IiJ/EXrAyPca7m94nqHBmQSsWZcdH2kB/:lG55XP0Vq9IiKXrxkKNqHBmEHNVKA
Score

10^/10

ryuk credential_access discovery ransomware stealer spyware
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Ryuk family
  ryuk
- Renames multiple (2060) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2