- Table of contents
The author
Table of contents
Related Articles
Ryuk Crypto-Ransomware
Executive Summary
First identified in 2018, ‘Ryuk’ is a known malware often dropped on a system by other malware, most notably TrickBot and Bazaarloader by using a Spear Phishing lure or other systems access gains via Remote Desktop Services. Ryuk demands payment via Bitcoin cryptocurrency and directs victims to deposit the ransom in a specific Bitcoin wallet.
The ransom demand is typically between 15-50 Bitcoins, which is roughly $100,000-$500,000 depending on the price conversion. Once on a system, Ryuk will steal credentials in order to spread through the network using PsExec, WMI, Powershell or Group Policy trying to infect as many endpoints and servers as possible while evading from Endpoint Controls. The malware will then begin the encryption process, specifically targeting backups, and successfully encrypting them in most cases, and in most cases, install a Cobalt Strike beacon to further solidify the control on the affected resources.
Ryuk’s targets tend to be high-profile organizations where the attackers know they are likely to get paid their steep ransom demands, usually from the Health industry. Victims include EMCOR, UHS hospitals, and several newspapers. In targeting these organizations, Ryuk was estimated to have generated a revenue of $61 million for its operators between February 2018 and October 2019 [5].
Ryuk is often the last piece of malware dropped in an infection cycle that starts with either Emotet or TrickBot. Multiple malware infections may greatly complicate the process of remediation. There was an increase in cases where Emotet or TrickBot are the initial infections and multiple malware variants are dropped onto the system with the end result being a Ryuk infection. Since TrickBot is a banking trojan, it likely harvested and exfiltrated financial account information on the infected systems prior to dropping the Ryuk ransomware infection.
Ryuk is one of the first ransomware families to include the ability to identify and encrypt network drives and resources, including shadow copies deletion on the endpoint. This means the attackers can then disable Windows System Restore for users, making it impossible to recover from an attack without external backups or rollback technology.
The group behind Ryuk ransomware distribution, UNC1878 continues to target various industries including healthcare relying on BazarBackdoor. Currently, the healthcare and social services targeting comprises 13.36% of the total victim by industries.
Delivery
As with many malware attacks, the delivery method is malspam. These emails are often sent from a spoofed address, so the sender name does not raise suspicion. The payload sent to victims is hardcoded with unique and specific IP’s, meaning every campaign is in fact unique and tailored per victim (either organization, sector or individual):
Figure 1: Lure sent to the victim
A typical Ryuk attack begins when a user opens a weaponized Microsoft Office document attached to a phishing email.
More potential subjects may include the following:
- 9100091 Canada Inc.
- {First Name} {Last Name}
- {Company Name} SIGNS PAYMENT NOTIFICATION 10.14.2020
- {Last Name}, {First Name} Payment Summary – Ref Id: D504336
- RE: Title conditions
- {Last Name}, {First Name}
- my visit and call
- RE: {Company Name}
- upcoming commercials for approval- {Redacted}
- RE: {Company Name} URGENT sept 19th if possible- please read email
- Borrowing Base Certificate, A/R Aging, and Inventory listing from {Company Name}?
- {Last Name}, {First Name}
- Re: File # {Redacted}, Loan # {Redacted}, {Company Name}, {Address}
- {Last Name}, {First Name}
- {Last Name} {First Name}
- {Last Name} and {Company Name} Back to Back 3-point games STAT
- October Statement – {Company Name}
- Payment Advice – ACH Transfer Notification – Ref:[Redacted] / ACH credits
- Payroll – {Company Name}
- Please approve – {Company Name}
- Potential {First Name} {Last Name} Shutout STAT
- Purchase Order – {Redacted} TSA from {Company Name}
- RE: {First Name}, i’m waiting for a call
- RE: {First Name}, office meeting
- RE: {Last Name}
- Re: Automatisch antwoord: {Redacted} {First Name} {Last Name} —- BWA 03-2019
- Re: {First Name} {Last Name}
- RE: {Company Name}
- RE: {Redacted} – {Company Name} du 30 mars au 2 avril 2020
- RE: {Company Name} termination list
- RE: {Company Name} – Bonus
- RE: {First Name}, your task list
- RE: {Company Name} URGENT sept 19th if possible- please read email
- RE: {Redacted} Card, Monthly Payments
- RE: Purchasing Card documents
- RE: {Company Name} – {Redacted}
- RE: Re: Brick for {First Name}
- RE: RE: Enrollment Form for New Employee
- Re: RE: EXTERNAL: Delivery 11-07-19
- Re: RE: Loan Request
- Re: RE: Local/Indy Radio Show
- Re: RE: {Redacted} cARD
- RE: RE: returned check NSF
- RE: Report for {First Name}
- RE: {Last Name}
- RE: Securemail Payoff amounts needed
- RE: {Company Name} Bank Employee Survey
- revised commercial
- {Company Name} Advisors Access Online
- March Statement – {Company Name}
- Please approve
- {First Name} {Last Name} Online Payment – Ref Id: {Redacted}
- RE: {First Name}, debit confirmation
- Re: debit
- RE: my call
- Re: my visit and call
Infection
Couple of infection methods were observed:
- External download of different types of binaries (Trickbot, Emotet).
- Office file, embedded with a malicious macro.
In the case of the attached office file, opening the document causes a malicious macro to execute a PowerShell command that attempts to download the banking Trojan Emotet. This Trojan has the ability to download additional malware onto an infected machine that retrieves and executes Trickbot, of which the main payload is spyware. This collects credentials, performs privilege escalation, attempts to evade endpoint security controls, deleting shadow copies using “vssadmin”, gains persistency using “Task Scheduler”, and allows attackers to move laterally to critical assets connected to the network. The attack chain concludes when the attackers execute Ryuk on each of these assets, and in other instances observed, when a Cobalt Strike beacon is installed.
Figure 2: Ransom letter on the victim’s desktop
Figure 3: Ransom letter on the victim’s desktop
For encryption, Ryuk uses the RSA and AES encryption algorithms with three keys. The Threat Actors use a private global RSA key as the base of their model. The second RSA key is delivered to the system via the main payload. This RSA key is already encrypted with the TA’s private global RSA key. Once the malware is ready for encryption, an AES key is created for the victim’s files and this key is encrypted with the second RSA key. Ryuk then begins scanning and encrypting every drive and network share on the system. Finally, it will create the ransom note, “RyukReadMe.txt” and place it in every folder on the system.
Based on the following sample d8ab0c6982ea7674ed4e53e4bfc7234a56b018090819b79f67a9cc6034fc98e2, the payload was signed by a uniquely revoked certificate:
-----BEGIN CERTIFICATE-----
MIIFnzCCBIegAwIBAgIQDtGEeirl1x3vHoM/3dM9ODANBgkqhkiG9w0BAQsFADBsMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBFViBDb2RlIFNpZ25pbmcgQ0EgKFNIQTIpMB4XDTIwMDgyOTAwMDAwMFoXDTIxMDcyODEyMDAwMFowgbgxEzARBgsrBgEEAYI3PAIBAxMCUlUxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRYwFAYDVQQFEw0xMTc3MjMyMDMxMTI5MQswCQYDVQQGEwJSVTEWMBQGA1UECBMNVHl1bWVuIE9ibGFzdDEPMA0GA1UEBxMGVHl1bWVuMRkwFwYDVQQKExBTTkFCLVJFU1VSUywgT09PMRkwFwYDVQQDExBTTkFCLVJFU1VSUywgT09PMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2BROr8bWxOPUv9VIf/fup+h1wAsCes4UDudLptw4HImyB6MeXgJDp460CqaZeWy/0OHvQ2rxTJUqtM7yiJ4rG5p5YmW1tFFuc3cQ+qzypje4XXopLUbk1T22yrBg0wt4jsDN8boTacel254Q1gYDVzFSk0TeWzbYrJim5PeIkWoiNrj0jWaXtg2uAzKCz4Y6V0rfR5k5rYJKvT0ujhIPOnW+ALrlOQyNMTxlQ1Ws7ft1WeSATGxlG5yIoub62HynAsVix64o/bRE8b1/0Wg4Pv5UQHxxDJaqSMC8H7YgSCYMxqRIXp1YE2NPk3LqlItuP6TQQSFthsz6+8QHxhCa9QIDAQABo4IB7jCCAeowHwYDVR0jBBgwFoAUj+h+8G0yagAFI8dwl2o6kP9r6tQwHQYDVR0OBBYEFFTvvgC5Rbpqc3Fe/6iF+765o+IhMCsGA1UdEQQkMCKgIAYIKwYBBQUHCAOgFDASDBBSVS0xMTc3MjMyMDMxMTI5MA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzB7BgNVHR8EdDByMDegNaAzhjFodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRVZDb2RlU2lnbmluZ1NIQTItZzEuY3JsMDegNaAzhjFodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRVZDb2RlU2lnbmluZ1NIQTItZzEuY3JsMEsGA1UdIAREMEIwNwYJYIZIAYb9bAMCMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwBwYFZ4EMAQMwfgYIKwYBBQUHAQEEcjBwMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wSAYIKwYBBQUHMAKGPGh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEVWQ29kZVNpZ25pbmdDQS1TSEEyLmNydDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4IBAQCEYFoK24Y3W/FljRd3XH6YOOAM6x8zu+zRp5jdWsBy4lor8dS/sQk6uLBaQCLw9QYDnMVRmI0yIUbeYFoOwlrPLu+MoKT7iNJg3Q3KQdxUkFZQ4Z+JKnt8TaUTRo6YFnoCZP/izPxVz+LL8BlIeH6jpY68eeAbAqkTwbzirusLZWVy/+lWrvq0Uz8+T9zJm+LsQk1aBNg8ysBnyNRlnMqyzlk5qnEzRWAdbqxSCdHpg6qob3HDzyi29EMNtlWGB7sdPHHmc1WuXz/7KlhDUM67jXV59lJBeRjxtHWe0xsiw4pMQ4wJfVbg6GvinvmWp/L46VOUr4y7vkfzRvMdKfIq
-----END CERTIFICATE-----
Common Name: SNAB-RESURS, OOO
Subject Alternative Names: othername:<unsupported>
Organization: SNAB-RESURS, OOO
Locality: Tyumen
State: Tyumen Oblast
Country: RU
Valid From: August 28, 2020
Valid To: July 28, 2021
Issuer: DigiCert EV Code Signing CA (SHA2), DigiCert Inc Write review of DigiCert
Serial Number: 0ed1847a2ae5d71def1e833fddd33d38
Fingerprint (SHA-1): E611A7D4CD6BB8650E1E670567AC99D0BF24B3E8
Fingerprint (MD5): 716771EFD0B8D4AD6B3DB6FDF4BA1DFC
Every file signed by this certificate is considered as a known malicious payload, linked to the Bazaarloader malware family.
Command & Control
Upon the successful infection of the targets, the malware keeps a command and control (C2) connection to a variety of different IP’s and domains, including the Cobalt Strike beacon, that allows the attackers to maintain full control of the infected resources, using a specific set of User Agents communicating over HTTPHTTPS protocols and to common paths (.css, .php, .js) in order to minimize potential exposure.
Cyberint’s Research team was able to map out a potential list of C2 servers and domains used by UNC1878 and linked to Trickbot and Ryuk, using Cobalt Strike as a communication channel.
Based on the following sample d8ab0c6982ea7674ed4e53e4bfc7234a56b018090819b79f67a9cc6034fc98e2 that had hardcoded communication IP ( 45.147.229.44 and backup-helper.com), clearly indicated this specific sample was created to target a single victim.
This specific IP revealed a unique server metadata and a self-signed HTTPS certificate that were later used to pivot on:
The specific server tag used, Server: golfe2 is a clear indication for the Cobalt Strike beacon C2 server.
The 443 HTTPS certificate contained a unique organization, lol including an interesting location – Taxsa instead of Texas. That is an original miss-type by the threat group.
Domains that uses the lol organization certificates were all registered by the following email addresses, making it easy to continue and map out the Ryuk C2 domains:
gaskinss@protonmail.comhakunamatata222@protonmail.comjames4041238767@protonmail.comhighcicker@protonmail.com
The Cobalt Strike communication protocol mapping, being used by Ryuk and linked to these servers and domains, allowed to create a more recent and assured list of Cobalt Strike servers that are in fact part of the campaign.
As the services used as communication channels responds with empty responses when directly accessed, specific paths are used in order to mask communications. As can be seen below, paths are consisted of different .css files:
HostIP: 45.147.229.44HostPort: 443URIResponseArch: x86, x64BeaconType: 8 (HTTPS)Port: 443Polling: 60283Jitter: 39Maxdns: 249C2Server: mn.backup-helper.com,/template.css,nm.backup-helper.com,/fam_calendar.css,ws.backup-helper.com,/fam_calendar.css mn.backup-helper.com,/template.css,nm.backup-helper.com,/template.css,ws.backup-helper.com,/fam_calendar.cssUserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246HTTPMethodPath2: /gv /fam_newspaperDNSIdle: \\x1E\\xBEI\\x86DNSSleep: 0Method1: GETMethod2: POSTSpawnto_x86: %windir%\\syswow64\\regsvr32.exeSpawnto_x64: %windir%\\sysnative\\regsvr32.exeProxyAccessType: 2 (Use IE settings)
Recommendations
- Create a dedicated backup plan for critical assets and resources.
- Create and set up a Business Continuity Plan.
- Sharpen Incident Response processes.
- Deploy strong endpoint protection controls (AV and EDR).
- Phishing awareness to be raised to all personnel.
- In case of impact, Cyberint recommends not to pay the ransom.
- Enable MFA on all personnel accounts.
- Block the following lists of IOC’s on the relevant network control used in your organization.
Indicators Of Compromise
Malware IOC’s:
0749bf91a4fb4a8d74096ea4d202e07f3dc72feb693008b1d0b1ee68c3f802810856b3c06805d3935b1db325c4e9c9131572b4cf09f07d989911495807775cab093f2b5a9d4628d9331751d7e6d3582cf097ab3f4091463ec895052dee8d22c30d6a7a2c2d9ae89bf54f199fb63c67424d6e242777060971ee53b62dedad40961c6ac3c02428dadf42ff0cdbb9fd065187417b0cf9b94fce4c17325319b8417e1e35935ac6307baef04e92907b1afd15e1ee7f0ed990fa14cce8c01a9e45381e21cb81424dc1921344bd1cd9ad7c870fbcaadbe2e9f499d7863e9a06d7de6ee03090242812c446fcdcd906f3580b9af0889e4efae53f86da291a24eaa547feed32e51accf5a30da12e43b3c7f83867577fcd6fb363d7773a743ab1bbb9653d06364a38d0c2456cc21bc0d248c1233a8d0e47b988a03be3896ad760544b23133637ebdaa9539ebdd7606e29dc66f048bb70042d03e75ddc01147cd8277ce0509b3bb2399020106bef03b8471a9e6af93540ff6b8d778802c9893ec7f7f526483c3f58610586c87bb8b9f2e93768c5f289fe39ca8570902165df5d340bedc622474685e91b859b372b955c11d8d68fd562fad478520a2f4a05c46d1fe6fb991b615b07ccbbf8f7b7a34bf03a254431fe36cc34cfac41bb8a72c55b9050fa8696c960209d8d5fa136ccf63fef84d8a8242747ec46393dd5329d4433263e4af1dc9e6c7f43434e5db8703c0a47dedeeab976159d8704bfbe2e4ff65405f38d508e9d87693ec2a560055d9d03869ba60a3209ede4739dc48c9719982abf7ed2d5fc868fbb33ae75d79566d8a3682d500be2668376e1a79b193ca0d1d6a280822cb0f692f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed9a11e1b2a6821857e1990a004447e35692d04e5b7d237697fbcc90b5198e3719D7333223DCC1002AAE04E25E31D8C297EFA791A2C1E609D67AC6D9AF338EFBE8a3b2528b5e31ab1b82e68247a90ddce9a1237b2994ec739beb096f71d58e3d5ba4b5ccb2649742c9c1070f48b46957585830b0acda29a704b146632b46c99c9ea8a5aa848cf8b1db1ca8b5ff827cb448d7bc34087369e6cbb621d6b9eadc4513ba2a96dae66324df5bbb0751a04c538722ad49daa12d51625f8a1890608b1168be876bc541afcde1fd4da7c1eb4ae2cfae6037854fbd3881ca652ed1cfd0d0c3bfad59ad62d310c2f435c02e6e7621a3ff8779b15029e6f949efe4eeb539a709c1f753047a0a5679aea0f675846364ea2f1fc4f9370f6caa89d0bfb1feb561f1c8076d0aa251a8c767e5f4c32c29588d46ffbed1709acaf9ca38b9d02ef7e276c9b06152ac1c851eaed84ee052c374341ed89d9a6e5a5d97bd0e4b941c01a274ca5976f473e0daf3754f9b4edd90ad4b02a484968959b68c1df878e6b7315031cc1c6834480497598c17952b72e93f4b71ce4670f33558857e7ca87b55135013cf535eb0782fd0ee4c246fcca439c85b79f5854e80ae1128d6314b7d76fef110d0d7a8f588693b7cc967fb4069419125625eb7454ba553c0416f35fc95307cbedfd5e26b62d9731d93b2ce8ec87bbf70fd63e4cd4e04d44dad3d82ca2f5e90fae8a3e804a96c716a3e9b69195db6ffb0d33e2433af871e4d4e1eab3097237173e8f09ceb5ee129b9c8c6970f9013bc9cdc7458ca6a0d935a9f48518418052d06edd0675e0fcce16ae7cbb1f10fbb8407ca5e0a188eab9682f43744c95e09f1c9ff5e6fbf14c5eb35c1b4f24e4b08b30ba2e512a4b25ab7b652f0567edb94097e
Command & Control (C2) IP’s:
104.156.227.250104.156.245.0104.156.250.132104.238.190.126104.248.83.13107.173.58.175107.173.58.176107.173.58.179107.173.58.180107.173.58.182107.173.58.183107.173.58.184107.173.58.185108.177.235.53108.61.176.237108.61.209.121108.61.209.123108.61.242.184108.61.72.29108.61.90.90108.62.12.105108.62.12.114108.62.12.116108.62.12.119108.62.12.12108.62.12.121109.70.236.134134.122.116.114134.122.116.59134.122.118.46134.122.124.26134.122.20.117140.82.10.222140.82.27.146140.82.5.67140.82.60.155144.202.12.197144.202.83.4149.248.5.240149.248.56.113149.248.58.11149.28.122.130149.28.15.247149.28.246.25149.28.35.35149.28.50.31149.28.55.197155.138.135.182155.138.136.182155.138.214.247155.138.216.133159.203.36.61159.65.216.127165.22.125.178165.227.196.0172.241.27.65172.241.27.68172.241.27.70178.62.247.205178.79.132.82179.43.128.3179.43.128.5179.43.133.44179.43.158.171179.43.160.205185.184.223.194185.25.50.167188.166.52.176190.211.254.154192.241.143.121193.142.58.129194.26.29.201194.26.29.202194.26.29.219194.26.29.220194.26.29.225194.26.29.226194.26.29.227194.26.29.229194.26.29.230194.26.29.232194.26.29.234194.26.29.235194.26.29.236194.26.29.237194.26.29.239194.26.29.242194.26.29.243194.26.29.244194.26.29.247198.211.116.199199.247.13.144207.148.15.31207.148.21.17207.148.8.61207.246.67.70209.222.108.106209.97.130.197213.252.244.126213.252.244.170213.252.244.38213.252.244.62213.252.245.71213.252.246.144213.252.246.154216.155.157.249217.69.15.17531.7.59.14145.138.172.9545.141.86.15545.141.86.20645.141.86.8445.141.86.9045.141.86.9145.141.86.9245.141.86.9345.141.86.9445.141.86.9545.141.86.9645.141.86.9745.141.86.9845.147.229.18045.147.229.4445.147.229.5245.147.229.6845.147.229.9245.147.230.13145.147.230.13245.147.230.13345.147.230.14045.147.230.14145.147.230.15945.147.230.8745.147.231.22245.153.240.13645.153.240.13845.153.240.15745.153.240.17845.153.240.19445.153.240.22045.153.240.22245.153.240.24045.153.241.145.153.241.13445.153.241.13845.153.241.13945.153.241.1445.153.241.14145.153.241.14645.153.241.15345.153.241.15845.153.241.16745.32.130.545.32.170.945.32.30.16245.34.6.22145.34.6.22245.34.6.22345.34.6.22545.34.6.22645.34.6.22945.63.95.18745.76.167.3545.76.20.14045.76.231.19545.76.45.16245.76.49.7845.77.119.21245.77.153.7245.77.206.10545.77.58.17245.77.89.3145.77.98.15746.19.142.1545.2.64.1135.2.64.1335.2.64.1355.2.64.1445.2.64.1495.2.64.1675.2.64.1725.2.64.1745.2.64.1825.2.72.2005.2.72.2025.2.79.105.2.79.125.2.79.1215.2.79.12263.209.33.13164.44.131.10366.42.118.12366.42.86.6169.55.60.14069.61.38.13269.61.38.15569.61.38.15669.61.38.15774.118.138.11574.118.138.13774.118.138.13874.118.138.13979.124.60.11780.240.18.10681.17.25.21081.17.28.10581.17.28.12281.17.28.7088.119.171.5588.119.171.6788.119.171.6888.119.171.6988.119.171.7388.119.171.7488.119.171.7588.119.171.7688.119.171.7788.119.171.7888.119.171.9488.119.171.9688.119.171.9788.119.174.10788.119.174.10988.119.174.11088.119.174.11488.119.174.11688.119.174.11788.119.174.11888.119.174.11988.119.174.12088.119.174.12188.119.174.12588.119.174.12688.119.174.12788.119.174.12888.119.174.13388.119.174.13988.119.175.15388.119.175.21495.179.147.21595.179.210.895.179.215.22895.179.219.16996.30.192.14196.30.193.5796.9.209.21696.9.209.21796.9.225.14396.9.225.144
Command & Control (C2) domains:
360footwears[.]com3bysybsybs54syb44by[.]xyzaaatus[.]comactionshunter[.]comartappartberlin[.]comavrenew[.]comayechecker[.]comayiyas[.]combackup-helper[.]combackup-leader[.]combackup-simple[.]combackup1helper[.]combackup1master[.]combackup1nas[.]combackup1service[.]combackup1services[.]combackuphel[.]combackupmaster-service[.]combackupmasterservice[.]combackupmastter[.]combackupnas1[.]combackups1helper[.]combackupslive[.]combakcup-checker[.]combakcup-monster[.]combeerpong101[.]combest-backup[.]combest-nas[.]combestservicehelper[.]combesttus[.]combigtus[.]combiliyilish[.]combithunterr[.]comblackhoall[.]comboost-helper[.]comboost-servicess[.]comboost-yourservice[.]comboostsecuritys[.]comboostyourservice[.]combouths[.]combrainschampions[.]combugsbunnyy[.]comcantliee[.]comcaonimas[.]comchainnss[.]comchalengges[.]comcheapshhot[.]comcheck1domains[.]comcheck1drivers[.]comcheck4list[.]comcheckhunterr[.]comchecksservice[.]comchecktodrivers[.]comcheckwinupdate[.]comchekingking[.]comciscocheckapi[.]comcitylifedns[.]comcleardefencewin[.]comclient-update[.]xyzcmdupdatewin[.]comcomssite[.]comconhostservice[.]comcylenceprotect[.]comdaggerclip[.]comdebug-service[.]comdefenswin[.]comdevelopmasters[.]comdomnasemg[.]comdotmaingame[.]comdrive-boost[.]comdrivegit[.]comdriver-boost[.]comdriver-boosters[.]comdriver-upd[.]comdriver1downloads[.]comdriver1master[.]comdriver1updater[.]comdriverdwl[.]comdriverjumper[.]comdriversna[.]comdriversupd[.]comdwndrivers[.]comeasytus[.]comeighteenthservicehelper[.]comeighthservicehelper[.]comeighthserviceupdater[.]comeithtservice-developer[.]comelephantdrrive[.]comeleventhservicehelper[.]comeleventhserviceupdater[.]comerrvghu[.]comexplore-me[.]xyzfashionday[.]monsterfastbloodhunter[.]comfifteenthservicehelper[.]comfifthservice-developer[.]comfifthservicehelper[.]comfifthserviceupdater[.]comfind1drivers[.]comfind1service[.]comfindtus[.]comfirstservice-developer[.]comfirstserviceupdater[.]comfirstservisehelper[.]comfirsttus[.]comfourservicehelper[.]comfourteenthservicehelper[.]comfourthservice-developer[.]comfourthserviceupdater[.]comfreeallsafe[.]comfreeoldsafe[.]comgameleaderr[.]comgetinformationss[.]comgiveasees[.]comgodofservice[.]comgreattus[.]comgrowtancy[.]comgtrsqer[.]comgungameon[.]comgunsdrag[.]comhakunaman[.]comhakunamatatata[.]comharddagger[.]comhashsystem[.]xyzhavemosts[.]comhavesetup[.]nethelpforyourservice[.]comhotlable[.]comhtpdomrtx[.]comhunbabe[.]comhungrrybaby[.]comhuntersservice[.]comhurrypotter[.]comhustlerclubnewyork[.]comhustlernewyorkstripclub[.]comhustlernycstripclub[.]comhustlernystripclub[.]comhustlerstripclub[.]comhybriqdjs[.]comiamcrazy[.]lolibackupboost[.]comibackupupdate[.]comibackupview[.]comidriveboost[.]comidrivecheck[.]comidrivedownload[.]comidrivedwn[.]comidrivefinder[.]comidrivehepler[.]comidriverrs[.]comidriveupdate[.]comidriveview[.]comiexploreservice[.]comimagodd[.]comimasterupdate[.]cominfo-develop[.]comiservicec[.]comit1booster[.]comitopupdater[.]comiupdatemaster[.]comiupdaters[.]comjomamba[.]bestjonsonsbabyy[.]comkamitorishoji[.]comkungfupandasa[.]comlindasak[.]comlivecheckpointsrs[.]comlivehealths[.]comlivetus[.]comloockfinderrs[.]comloxliver[.]comlsassupdate[.]comlsasswininfo[.]comluckyhunterrs[.]commartahzz[.]commaybebaybe[.]commicrosoftupdateswin[.]commixunderax[.]commoonshardd[.]commountasd[.]commyobtain[.]commyservicebooster[.]commyservicebooster[.]netmyserviceconnect[.]netmyserviceupdater[.]commyyserviceupdater[.]comnas-helper[.]comnas-leader[.]comnas-simple-helper[.]comnasbooster[.]comnashelper[.]comnasmasterservice[.]comnasmastrservice[.]comnasupdater[.]comncedrive[.]comnewservicehelper[.]comnidonya[.]pp[.]uanineteenthservicehelper[.]comninethservice-developer[.]comninethserviceupdater[.]comninthservicehelper[.]comnomadfunclub[.]comopen1vpn[.]comprimeviref[.]compuckhunterrr[.]compudgeee[.]comqascker[.]comquwasd[.]comraaidboss[.]comraidbossa[.]comrapirasa[.]comrazorses[.]comrealgamess[.]comregbed[.]comreginds[.]comremotessa[.]comrenovatesystem[.]comrulemonster[.]comrun-tcp[.]comrun-tcp[.]inforun-tcp[.]merun-tcp[.]netrun-upgrade[.]monsterrun-upgrade[.]xyzsaynoforbubble[.]comscrservallinst[.]infosecondlivve[.]comsecondservice-developer[.]comsecondservicehelper[.]comsecondserviceupdater[.]comservice-boost[.]comservice-booster[.]comservice-boosterr[.]comservice-boostter[.]comservice-checker[.]comservice-hel[.]comservice-hellper[.]comservice-helpes[.]comservice-hunter[.]comservice-leader[.]comservice-updateer[.]comservice-updater[.]comservice1boost[.]comservice1upd[.]comservice1update[.]comservice1updater[.]comservice1view[.]comserviceboosterr[.]comserviceboostnumberone[.]comservicecheckerr[.]comservicedbooster[.]comservicedhunter[.]comservicedpower[.]comservicedupdater[.]comservicegungster[.]comservicehel[.]comservicehellps[.]comservicehunterr[.]comservicemonsterr[.]comservicemount[.]comservicereader[.]comservicesbooster[.]comservicesbooster[.]orgservicesecurity[.]orgservicesen[.]comservicesgit[.]comserviceshelpers[.]comserviceshelps[.]comservicesupdater[.]comservicesups[.]comserviceswork[.]netserviceupdates[.]netserviceupdatter[.]comserviceuphelper[.]comservicewikii[.]comseventeenthservicehelper[.]comseventhservice-developer[.]comseventhservicehelper[.]comseventhserviceupdater[.]comsexycservice[.]comsexyservicee[.]comshabihere[.]comsibalsakie[.]comsimple-backupbooster[.]comsimpleservice-checker[.]comsixteenthservicehelper[.]comsixthservice-developer[.]comsixthservicehelper[.]comsixthserviceupdater[.]comsobcase[.]comsophosdefence[.]comsunofgodd[.]comsupservupdate[.]comsweetmonsterr[.]comtarget-support[.]onlinetarhungangster[.]comtaskshedulewin[.]comtenthservice-developer[.]comtenthservicehelper[.]comtenthserviceupdater[.]comthecheckupdater[.]comthespunj[.]comthirdservice-developer[.]comthirdservicehelper[.]comthirdserviceupdater[.]comthirteenthservicehelper[.]comtiancaii[.]comtimesshifts[.]comtop-backuphelper[.]comtop-backupservice[.]comtop-servicebooster[.]comtop-serviceupdater[.]comtop3-services[.]comtop3servicebooster[.]comtopbackup-helper[.]comtopbackupintheworld[.]comtopsecurityservice[.]nettopservice-masters[.]comtopservicebooster[.]comtopservicehelper[.]comtopservicesbooster[.]comtopservicesecurity[.]comtopservicesecurity[.]nettopservicesecurity[.]orgtopservicesupdate[.]comtopservicesupdates[.]comtopserviceupdater[.]comtukunavi[.]comtwelfthservicehelper[.]comtwelvethserviceupdater[.]comtwentiethservicehelper[.]comu6ycrtduvb6d5rttvub6d5[.]comuncheckhel[.]comunlockwsa[.]comupdate-chromeservices[.]comupdate-wind[.]comupdate-wins[.]comupdatemanagir[.]usupdatewinlsass[.]comupdatewinsoftr[.]comupddrivers[.]comupdsql[.]meview-backup[.]comview1drive[.]comview1drivers[.]comviewdrivers[.]comvloerplan[.]comvnuret[.]comvoiddas[.]comweb-analysis[.]livewindefenceinfo[.]comwindefens[.]comwinsysteminfo[.]comwinsystemupdate[.]comwodemayaa[.]comwondergodst[.]comworldtus[.]comx3q24wxc54vd6b5f7[.]bestyourserviceupdater[.]comyoursuperservice[.]comzapored[.]comzetrexx[.]comzhameharden[.]com
Yara Rule
The following Yara rule, created by McAfee Advanced Threat Research can be use to detect new Ryuk samples:
rule Ransom_Ryuk_sept2020 {
meta:
description = "Detecting latest Ryuk samples"
author = "McAfee ATR"
date = "2020-10-13"
malware_type = "ransomware"
malware_family = "Ransom:W32/Ryuk"
actor_type = "Cybercrime"
actor_group = "Unknown"
hash1 = "cfdc2cb47ef3d2396307c487fc3c9fe55b3802b2e570bee9aea4ab1e4ed2ec28"
strings:
$x1 = "" /TR ""C:\Windows\System32\cmd.exe /c for /l %x in (1
