Overview

overview

10

Static

static

3

2025-03-20...uk.exe

windows7-x64

10

2025-03-20...uk.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2025-03-20_89638b8691bbabd7b3ff93c64612c8fa_ryuk
  • Size 139KB
  • Sample250320-b4grwstmx7
  • SHA256 5d3d9b6382e76ef0385c275bff4cb58893befc6e5289e9023eace844ce87119f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ryukcredential_accessdiscoveryransomwarestealer

Malware Config

Extracted

Path

  • C:\users\Public\RyukReadMe.html

  • ryuk

Ransom Note
  • contact balance of shadow universe Ryuk $password = 'qAw3tyv'; $torlink = 'http://v6nhthxmhpfsody4hitwmk3ug4tavdwl2av57qqid2lvz3nppikrmxqd.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};
URLs

  • http://v6nhthxmhpfsody4hitwmk3ug4tavdwl2av57qqid2lvz3nppikrmxqd.onion

Targets

    • Target
      2025-03-20_89638b8691bbabd7b3ff93c64612c8fa_ryuk
    • Size 139KB
    • SHA256 5d3d9b6382e76ef0385c275bff4cb58893befc6e5289e9023eace844ce87119f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    ryukcredential_accessdiscoveryransomwarestealer

    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

      ransomwareryuk

    • Ryuk family

      ryuk

    • Renames multiple (5528) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks