Overview

overview

10

Static

static

3

2025-08-08...uk.exe

windows10-2004-x64

7

2025-08-08...uk.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2025-08-08_853d7f8d82eab15b9659de745dfd270a_black-basta_ryuk
  • Size 203KB
  • Sample250808-hvt47azyav
  • SHA256 cade950af4a6250075c9ef49765f1501212bb8e84c1a40657e508c6263f97737
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ryukdiscoveryransomware

Malware Config

Extracted

Path

  • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\RyukReadMe.html

  • ryuk

Ransom Note

Targets

    • Target
      2025-08-08_853d7f8d82eab15b9659de745dfd270a_black-basta_ryuk
    • Size 203KB
    • SHA256 cade950af4a6250075c9ef49765f1501212bb8e84c1a40657e508c6263f97737
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryryukransomware

    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

      ransomwareryuk

    • Ryuk family

      ryuk

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks