Ryuk - Report-Review22-10.exe [327da452]

Tehdit Valeurlendirmesi

Bu ornek, kurban sistemindeki dosyaları sifreleyerek erisimi engelleyen ve sifre cozme anahtarı karsılıgında fidye talep eden bir fidye yazılımı olarak analiz edilmistir.

Capacités détectées

• Fichier Sifreleme
• Golge Kopya Silme
• Fidye Notu
• Yedek Yok Etme
• Veri Sizdirma

Étiquettes MalwareBazaar

Note d’analyse

Bu ornek Ryuk ailesine ait ve MalwareBazaar platformundan alınmıstır. KEYDAL Guvenlik Arastirmaları tarafından metadata analizi gerceklestirilmis ve IOC veritabanına eklenmistir.

Ryuk — Profil du malware

Wizard Spider threat group ransomware (2018+). Targets large enterprises, hospitals, municipalities. RyukReadMe.html ransom note. VirtualAllocEx+WriteProcessMemory+CreateRemoteThread injection. GetIpNetTable ARP scan for lateral movement. AdjustTokenPrivileges for SeBackupPrivilege/SeDebugPrivilege.

Type de malware

Ransomware

Langage de programmation

C

Protocole C2

—

Systèmes ciblés

Windows

Détails techniques

Ryuk ransomware emerged August 2018, operated by WIZARD SPIDER (TrickBot operators). Targeted large organizations for high ransoms ($100K-$12.5M+ per victim). Distribution: delivered via TrickBot/BazarLoader infections (human-operated). Encryption: RSA-2048 + AES-256 (CBC mode), unique key per file. Stops 40+ Windows services (backup, antivirus, database) and kills >180 processes. Deletes volume shadow copies (vssadmin delete shadows /all /Quiet). Disables Windows recovery: bcdedit /set {default} recoveryenabled No. Network propagation: uses Wake-on-LAN to activate sleeping network hosts for encryption. Believed based on Hermes ransomware sold by a North Korean-linked actor on underground forums. Predecessor to Conti ransomware which emerged from WIZARD SPIDER's operations in 2020.

Attribution / Acteur de la menace

WIZARD SPIDER (linked to Hermes/Lazarus initial code)

Capacités et comportement

Dosya Şifreleme (AES/RSA)

Gölge Kopya Silme

Yedek Kaldırma

Fidye Notu Oluşturma

Kalıcılık Sağlama

Ağ Paylaşımı Şifreleme

Anti-Analiz Teknikleri

Çift Gasp (Data Leak)

Liste IOC (2 indicateurs)

IOC — Ryuk Copier

# SHA256 327da452b8c86ed8910056646771de8fb92a928c3d135efb2d41e6cb26806382 # MD5 42513d9fbd45e442f8f499a7bb5746a2

Type	Valeur	Note
sha256	327da452b8c86ed8910056646771de8fb92a928c3d135efb2d41e6cb26806382
md5	42513d9fbd45e442f8f499a7bb5746a2

Serveurs C2 (2 serveurs enregistrés pour cette famille)

Adresse	Type	Port	Protocole	Statut	Pays
51.161.204.106	ip	443	HTTPS	sinkholed	CA
162.119.249.198	ip	443	HTTPS	sinkholed	US

Les adresses C2 proviennent uniquement d'échantillons de malwares vérifiés manuellement par l'équipe KEYDAL. Toute utilisation commerciale est interdite.