ryuk

General

Target

JaffaCakes118_59a777daa0a5b26077c69c7cb26b7f72be6b38604b7caea7c6aef0e89991c748
Size

7.8MB
Sample

241225-d9c21axjdn
MD5

4a9819c2f6c56a1275165c507a00c6e5
SHA1

5f1ef638e5d1d90c77d00f7a2e10757d90667e98
SHA256

59a777daa0a5b26077c69c7cb26b7f72be6b38604b7caea7c6aef0e89991c748
SHA512

e8e0a2eee2e4ad464687717a2aa67b2dcd3708da7307f8ed4382f9a72502ad5c98dc329aa1aa60ca6232bb35e9ba2245ea53de280488fe87829d84b7ca83bf5a
SSDEEP

196608:tk0ZvI6FNtoYRmqKSAEu8Dmf/aUR8BeOmR1RzfYmIxDa6yaDZu:tk2w66YIqTd4sDjE

Score

10^/10

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note

Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted or deleted or backup disks were formatted. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation No decryption software is available in the public. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. This may lead to the impossibility of recovery of the certain files. To get info (decrypt your files) contact us at [email protected] or [email protected] BTC wallet: 14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk Ryuk No system is safe

Emails

[email protected]

Wallets

14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk

Targets

- Target
  
  28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33
- Size
  
  321KB
- MD5
  
  04ba14a9828b000add142d0bcb42ac2d
- SHA1
  
  928a705a481384dee3aa9985bb2a9e1e6827902f
- SHA256
  
  28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33
- SHA512
  
  2fc56d6fdf360c0435f76822f3d99288c3b31462931eb128c7ed895bf93d88b00663801c1a5394b1ae5bb081ac76b004deaf46fdf2b0b9c027b2945a7c030909
- SSDEEP
  
  6144:ba4FsUiep6JzvI74kZO/+SJtwOW8HFBwK3SBDmhYfFQ:ba4Fs/7IfO/+SJFW8HF+KCIG
Score

10^/10

ryuk defense_evasion discovery execution impact persistence ransomware vmprotect
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Ryuk family
  ryuk
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Adds Run key to start application
  persistence
behavioral1 behavioral2