ryuk

General

Target

JaffaCakes118_2d3b8208e42e72b356add50649a91ffab352498a0cfe4a4c4828e6a331e63a6d
Size

71KB
Sample

241226-v6s3gssnds
MD5

6161c819bcaac48d9c704bfdac95a607
SHA1

4dff5f080d2c1c10382e41843c08c33fd67fc29d
SHA256

2d3b8208e42e72b356add50649a91ffab352498a0cfe4a4c4828e6a331e63a6d
SHA512

8dd1e9e0e29d21fc02a4145090071f2452b663f69768c1138f9e936033e6f4e06eb21a755c8705065ad50f60e351b822f2dd3437ce483ce90eb4e8bfc8e14948
SSDEEP

1536:63k6H50ZYoqjZiFr8Op6c3JxRar1c9CpZ4OV2wHY2DThbq22KmAl:/Y88Op6crUKeZ4A2wFhbq22a

Score

10^/10

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = 'TLS7ST8vlU'; $torlink = 'http://htv4omqldafxwhum7ya3m37o3zcbo2d7kidcpgvp6lky62gi6czx6iqd.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://htv4omqldafxwhum7ya3m37o3zcbo2d7kidcpgvp6lky62gi6czx6iqd.onion

Targets

- Target
  
  781bc4dcbd459893397a8b987bf697f5b95435dfaf7fe3f4d2224728e7a2202a.bin.sample
- Size
  
  139KB
- MD5
  
  8555b213260ba5eda4bf37652cecb431
- SHA1
  
  80bd92b996fce311b52aa791a8ace4b20f8fb7ab
- SHA256
  
  781bc4dcbd459893397a8b987bf697f5b95435dfaf7fe3f4d2224728e7a2202a
- SHA512
  
  0e4056303a68e4c3af5b639fdc0f434ab81452c4d06d92b97f4a8fa39383a7f963ac9dd09c4e89250678b9bc77b5f9bfd14efc294fd493ffa4c058215ba1b136
- SSDEEP
  
  3072:wuShhWSeiy0aRZCqU4/JjbWwpwHUSxMB+kF:BShMSeinEtv/JHbMMkk
Score

10^/10

ryuk credential_access discovery ransomware stealer
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Ryuk family
  ryuk
- Renames multiple (3218) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2