ryuk

General

Target

JaffaCakes118_51ec1631a41116543155d62343c319cc18fbc96ff69d13486628059c8996082d
Size

148KB
Sample

241225-c8xjksvrbk
MD5

d0cb4797148f5af81d9cd86afcf7b9a5
SHA1

a2848df8379f67728df6bc5bc3ea14c7407ff6c6
SHA256

51ec1631a41116543155d62343c319cc18fbc96ff69d13486628059c8996082d
SHA512

773419d7675a2a429c787183398a0239e4eb1672aba2ddbdd998f3bf1bb724868e8e5b3bc3098f6a2be8c61d69f5c91195abebf04fe59190fa61b87cd2a42f5e
SSDEEP

3072:VIKV6IS7ddwK2f83oIi2owcmRFyeTzIUZU34Nkg1pfnRlp5x5CJaXw:VIQ6jXwZeoI3RjTzK34bXp5iB

Score

10^/10

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = 'LrTkZZiNrw'; $torlink = 'http://piesa6sapybbrz63pqmmwdzyc5fp73b3uya5cpli6pp5jpswndiu44id.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://piesa6sapybbrz63pqmmwdzyc5fp73b3uya5cpli6pp5jpswndiu44id.onion

Targets

- Target
  
  2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79
- Size
  
  314KB
- MD5
  
  89e60fff097ebf9b27bc8aa9b1564da0
- SHA1
  
  9a1755bcfb3496290333f33b1b0b738016b868bf
- SHA256
  
  2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79
- SHA512
  
  a471d4ad11bb4fdb2adcf988a133a53a7b3b536681f421e1c13047bbfeeacfef3a232689de215a8bf81e55515c5cf92081e0b41893c56712bf328aae67de8055
- SSDEEP
  
  6144:G4VK8AmqOZPPdJkWOexxREJ2PptogBXNLqZrKZPz4WJA:Gr8A1OOy6J2PLdXNLWrO4WJA
Score

10^/10

ryuk credential_access discovery ransomware stealer spyware
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Ryuk family
  ryuk
- Renames multiple (1274) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2