Ryuk (Malware Family)

SYMBOL	COMMON_NAME	aka. SYNONYMS

win.ryuk (Back to overview)

Ryuk

Actor(s): FIN6, GRIM SPIDER, WIZARD SPIDER

Ryuk is a ransomware which encrypts its victim's files and asks for a ransom via bitcoin to release the original files. It is has been observed being used to attack companies or professional environments. Cybersecurity experts figured out that Ryuk and Hermes ransomware shares pieces of codes. Hermes is commodity ransomware that has been observed for sale on dark-net forums and used by multiple threat actors.

References

2020-03-25 ⋅ Wilbur Security ⋅ JW
Trickbot to Ryuk in Two Hours
Cobalt Strike Ryuk TrickBot

2020-03-05 ⋅ Microsoft ⋅ Microsoft Threat Protection Intelligence Team
Human-operated ransomware attacks: A preventable disaster
Dharma DoppelPaymer Dridex EternalPetya Gandcrab Hermes LockerGoga MegaCortex MimiKatz REvil RobinHood Ryuk SamSam TrickBot WannaCryptor

2020-03-04 ⋅ CrowdStrike ⋅ CrowdStrike
2020 CrowdStrike Global Threat Report
MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze Necurs Nokki Outlook Backdoor Phobos Ransomware Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot vidar Winnti ANTHROPOID SPIDER Anunak APT39 BlackTech BuhTrap Charming Kitten CLOCKWORD SPIDER DOPPEL SPIDER Gamaredon Group Judgment Panda Kryptonite Panda MONTY SPIDER Mustang Panda NARWHAL SPIDER NOCTURNAL SPIDER Pinchy Spider Pirate Panda Salty Spider SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER

2020-03-04 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Ryuk Ransomware Attacked Epiq Global Via TrickBot Infection
Ryuk TrickBot

2020-03-03 ⋅ PWC UK ⋅ PWC UK
Cyber Threats 2019:A Year in Retrospect
KevDroid MESSAGETAP magecart AndroMut Cobalt Strike CobInt Crimson RAT DNSpionage Dridex Dtrack Emotet FlawedAmmyy FlawedGrace FriedEx Gandcrab Get2 GlobeImposter Grateful POS ISFB Kazuar LockerGoga Nokki QakBot Ramnit REvil Rifdoor RokRAT Ryuk shadowhammer ShadowPad Shifu Skipper StoneDrill Stuxnet TrickBot Winnti ZeroCleare

2020-03-02 ⋅ c't ⋅ Christian Wölbert
Was Emotet anrichtet – und welche Lehren die Opfer daraus ziehen
Emotet Ryuk

2020-02-25 ⋅ RSA Conference ⋅ Joel DeCapua
Feds Fighting Ransomware: How the FBI Investigates and How You Can Help
FastCash Cerber Defray Dharma FriedEx Gandcrab GlobeImposter Mamba Phobos Ransomware Rapid Ransom REvil Ryuk SamSam Zeus

2020-02-10 ⋅ Malwarebytes ⋅ Adam Kujawa, Wendy Zamora, Jérôme Segura, Thomas Reed, Nathan Collier, Jovi Umawing, Chris Boyd, Pieter Arntz, David Ruiz
2020 State of Malware Report
magecart Emotet QakBot REvil Ryuk TrickBot WannaCryptor

2020-01-29 ⋅ ANSSI ⋅ ANSSI
État de la menace rançongiciel
Clop Dharma FriedEx Gandcrab LockerGoga Maze MegaCortex REvil RobinHood Ryuk SamSam

2020-01-29 ⋅ ZDNet ⋅ Catalin Cimpanu
DOD contractor suffers ransomware infection
Ryuk

2020-01-24 ⋅ ReversingLabs ⋅ Robert Simmons
Hunting for Ransomware
Ryuk

2020-01-24 ⋅ Bleeping Computer ⋅ Lawrence Abrams
New Ryuk Info Stealer Targets Government and Military Secrets
Ryuk

2020-01-14 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Ryuk Ransomware Uses Wake-on-Lan To Encrypt Offline Devices
Ryuk

2019-12-26 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Ryuk Ransomware Stops Encrypting Linux Folders
Ryuk

2019-12-21 ⋅ Decrypt ⋅ Adriana Hamacher
How ransomware exploded in the age of Bitcoin
Ryuk

2019-12-19 ⋅ Malwarebytes ⋅ Jovi Umawing
Threat spotlight: the curious case of Ryuk ransomware
Ryuk

2019-12-15 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Ryuk Ransomware Likely Behind New Orleans Cyberattack
Ryuk

2019-12-09 ⋅ Emsisoft ⋅ EmsiSoft Malware Lab
Caution! Ryuk Ransomware decryptor damages larger files, even if you pay
Ryuk

2019-11-27 ⋅ Twitter (@Prosegur) ⋅ Prosegur
Tweet on Incident of Information Security
Ryuk

2019-11-06 ⋅ Heise Security ⋅ Thomas Hungenberg
Emotet, Trickbot, Ryuk – ein explosiver Malware-Cocktail
Emotet Ryuk TrickBot

2019-11-01 ⋅ CrowdStrike ⋅ Alexander Hanel, Brett Stone-Gross
WIZARD SPIDER Adds New Features to Ryuk for Targeting Hosts on LAN
Ryuk WIZARD SPIDER

2019-11 ⋅ CCN-CERT ⋅ CCN-CERT
Informe Código Dañino CCN-CERT ID-26/19
Ryuk

2019-05-09 ⋅ GovCERT.ch ⋅ GovCERT.ch
Severe Ransomware Attacks Against Swiss SMEs
Emotet LockerGoga Ryuk TrickBot

2019-04-05 ⋅ FireEye ⋅ Brendan McKeague, Van Ta, Ben Fedore, Geoff Ackerman, Alex Pennino, Andrew Thompson, Douglas Bienstock
Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware
LockerGoga Ryuk FIN6

2019-04-02 ⋅ Cybereason ⋅ Noa Pinkas, Lior Rochberger, Matan Zatz
Triple Threat: Emotet Deploys Trickbot to Steal Data & Spread Ryuk
Ryuk TrickBot

2019-03-26 ⋅ ANSSI ⋅ ANSSI
INFORMATIONS CONCERNANTLES RANÇONGICIELSLOCKERGOGA ET RYUK
Ryuk

2019-01-11 ⋅ FireEye ⋅ Kimberly Goody, Jeremy Kennelly, Jaideep Natu, Christopher Glyer
A Nasty Trick: From Credential Theft Malware to Business Disruption
Ryuk TrickBot GRIM SPIDER WIZARD SPIDER

2019-01-10 ⋅ CrowdStrike ⋅ Alexander Hanel
Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware
Ryuk GRIM SPIDER MUMMY SPIDER STARDUST CHOLLIMA WIZARD SPIDER

2019-01-09 ⋅ McAfee ⋅ John Fokker, Christiaan Beek
Ryuk Ransomware Attack: Rush to Attribution Misses the Point
Ryuk

2019 ⋅ Virus Bulletin ⋅ Gabriela Nicolao, Luciano Martins
Shinigami's Revenge: The Long Tail of Ryuk Malware
Ryuk

2018-12-29 ⋅ Los Angeles Times ⋅ Tony Barboza, Meg James, Emily Alpert Reyes
Malware attack disrupts delivery of L.A. Times and Tribune papers across the U.S.
Ryuk

2018-08-20 ⋅ Check Point ⋅ Itay Cohen, Ben Herzog
Ryuk Ransomware: A Targeted Campaign Break-Down
Ryuk

Yara Rules

[TLP:WHITE] win_ryuk_auto (20190204 | autogenerated rule brought to you by yara-signator)

rule win_ryuk_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2019-11-26"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator 0.1a"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
        malpedia_version = "20190204"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using yara-signator.
     * The code and documentation / approach will be published in the near future here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */

    strings:
        $sequence_0 = { c3 4053 4883ec20 8bc1 498bd8 33c9 4c8bda }
            // n = 7, score = 600
            //   c3                   | dec                 eax
            //   4053                 | mov                 eax, ebx
            //   4883ec20             | dec                 eax
            //   8bc1                 | add                 esp, 0x30
            //   498bd8               | pop                 ebx
            //   33c9                 | ret                 
            //   4c8bda               | dec                 eax

        $sequence_1 = { 415e c3 4053 4883ec20 488bd9 33c9 48890b }
            // n = 7, score = 600
            //   415e                 | mov                 dword ptr [esp + 8], ebx
            //   c3                   | dec                 eax
            //   4053                 | mov                 dword ptr [esp + 0x10], ebp
            //   4883ec20             | ret                 
            //   488bd9               | inc                 eax
            //   33c9                 | push                ebx
            //   48890b               | dec                 eax

        $sequence_2 = { ff15???????? b803000000 eb05 b805000000 }
            // n = 4, score = 600
            //   ff15????????         |                     
            //   b803000000           | sub                 esp, 0x20
            //   eb05                 | mov                 eax, ecx
            //   b805000000           | dec                 ecx

        $sequence_3 = { 4983c8ff e8???????? 488bc3 4883c430 5b c3 48895c2408 }
            // n = 7, score = 600
            //   4983c8ff             | dec                 ecx
            //   e8????????           |                     
            //   488bc3               | or                  eax, 0xffffffff
            //   4883c430             | dec                 eax
            //   5b                   | mov                 eax, ebx
            //   c3                   | dec                 eax
            //   48895c2408           | add                 esp, 0x30

        $sequence_4 = { e8???????? e8???????? b9e8030000 ff15???????? }
            // n = 4, score = 600
            //   e8????????           |                     
            //   e8????????           |                     
            //   b9e8030000           | jmp                 0xc
            //   ff15????????         |                     

        $sequence_5 = { b809000000 e9???????? 4533c9 4533c0 }
            // n = 4, score = 600
            //   b809000000           | pop                 ebx
            //   e9????????           |                     
            //   4533c9               | ret                 
            //   4533c0               | dec                 eax

        $sequence_6 = { 4c8d05???????? 488d15???????? 488d0d???????? ff15???????? 85c0 }
            // n = 5, score = 600
            //   4c8d05????????       |                     
            //   488d15????????       |                     
            //   488d0d????????       |                     
            //   ff15????????         |                     
            //   85c0                 | dec                 eax

        $sequence_7 = { eb04 4883c020 4883c428 c3 48895c2408 57 4883ec30 }
            // n = 7, score = 600
            //   eb04                 | inc                 eax
            //   4883c020             | push                ebx
            //   4883c428             | dec                 eax
            //   c3                   | sub                 esp, 0x20
            //   48895c2408           | mov                 eax, ecx
            //   57                   | dec                 ecx
            //   4883ec30             | mov                 ebx, eax

        $sequence_8 = { 50 e8???????? 50 57 6800000030 e8???????? }
            // n = 6, score = 400
            //   50                   | push                eax
            //   e8????????           |                     
            //   50                   | push                eax
            //   57                   | push                edi
            //   6800000030           | push                0x30000000
            //   e8????????           |                     

        $sequence_9 = { 6800000030 e8???????? 83c408 85c0 }
            // n = 4, score = 400
            //   6800000030           | push                0x30000000
            //   e8????????           |                     
            //   83c408               | add                 esp, 8
            //   85c0                 | test                eax, eax

        $sequence_10 = { b900000030 2bc1 50 51 e8???????? 59 }
            // n = 6, score = 400
            //   b900000030           | mov                 ecx, 0x30000000
            //   2bc1                 | sub                 eax, ecx
            //   50                   | push                eax
            //   51                   | push                ecx
            //   e8????????           |                     
            //   59                   | pop                 ecx

        $sequence_11 = { 8b4508 2d00000030 50 6800000030 e8???????? }
            // n = 5, score = 400
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   2d00000030           | sub                 eax, 0x30000000
            //   50                   | push                eax
            //   6800000030           | push                0x30000000
            //   e8????????           |                     

        $sequence_12 = { 8d45f0 64a300000000 8965e8 c745fc00000000 6800000030 }
            // n = 5, score = 400
            //   8d45f0               | lea                 eax, [ebp - 0x10]
            //   64a300000000         | mov                 dword ptr fs:[0], eax
            //   8965e8               | mov                 dword ptr [ebp - 0x18], esp
            //   c745fc00000000       | mov                 dword ptr [ebp - 4], 0
            //   6800000030           | push                0x30000000

        $sequence_13 = { c745fc00000000 6800000030 e8???????? 83c404 85c0 7454 8b4508 }
            // n = 7, score = 400
            //   c745fc00000000       | mov                 dword ptr [ebp - 4], 0
            //   6800000030           | push                0x30000000
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   85c0                 | test                eax, eax
            //   7454                 | je                  0x56
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]

        $sequence_14 = { 6823110030 51 e8???????? 8bf0 }
            // n = 4, score = 300
            //   6823110030           | push                0x30001123
            //   51                   | push                ecx
            //   e8????????           |                     
            //   8bf0                 | mov                 esi, eax

        $sequence_15 = { 754f b90b010000 66398818000030 7541 8b4508 b900000030 2bc1 }
            // n = 7, score = 300
            //   754f                 | jne                 0x51
            //   b90b010000           | mov                 ecx, 0x10b
            //   66398818000030       | cmp                 word ptr [eax + 0x30000018], cx
            //   7541                 | jne                 0x43
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   b900000030           | mov                 ecx, 0x30000000
            //   2bc1                 | sub                 eax, ecx

        $sequence_16 = { 8d0c49 c1e103 51 6a00 }
            // n = 4, score = 200
            //   8d0c49               | lea                 ecx, [ecx + ecx*2]
            //   c1e103               | shl                 ecx, 3
            //   51                   | push                ecx
            //   6a00                 | push                0

        $sequence_17 = { 6a00 ffd6 6800400000 6a40 }
            // n = 4, score = 200
            //   6a00                 | push                0
            //   ffd6                 | call                esi
            //   6800400000           | push                0x4000
            //   6a40                 | push                0x40

        $sequence_18 = { 57 ff15???????? b80c000000 5f }
            // n = 4, score = 200
            //   57                   | push                edi
            //   ff15????????         |                     
            //   b80c000000           | mov                 eax, 0xc
            //   5f                   | pop                 edi

        $sequence_19 = { 2bf0 33c0 66890473 83ffff }
            // n = 4, score = 200
            //   2bf0                 | sub                 esi, eax
            //   33c0                 | xor                 eax, eax
            //   66890473             | mov                 word ptr [ebx + esi*2], ax
            //   83ffff               | cmp                 edi, -1

        $sequence_20 = { 6a00 ff15???????? 6a00 6a02 6a03 6a00 }
            // n = 6, score = 200
            //   6a00                 | sub                 eax, ecx
            //   ff15????????         |                     
            //   6a00                 | push                eax
            //   6a02                 | push                ecx
            //   6a03                 | add                 esp, 4
            //   6a00                 | test                eax, eax

        $sequence_21 = { c20400 8bff 55 8bec b8ffff0000 83ec18 }
            // n = 6, score = 200
            //   c20400               | push                eax
            //   8bff                 | push                ecx
            //   55                   | mov                 eax, dword ptr [ebp + 8]
            //   8bec                 | mov                 ecx, 0x30000000
            //   b8ffff0000           | sub                 eax, ecx
            //   83ec18               | push                eax

        $sequence_22 = { 6a0a c1e818 51 50 }
            // n = 4, score = 200
            //   6a0a                 | push                0xa
            //   c1e818               | shr                 eax, 0x18
            //   51                   | push                ecx
            //   50                   | push                eax

        $sequence_23 = { ff15???????? b808000000 5f 5e }
            // n = 4, score = 200
            //   ff15????????         |                     
            //   b808000000           | mov                 eax, 8
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi

        $sequence_24 = { 7e19 ff734c 4e 0fbe0406 }
            // n = 4, score = 100
            //   7e19                 | jle                 0x1b
            //   ff734c               | push                dword ptr [ebx + 0x4c]
            //   4e                   | dec                 esi
            //   0fbe0406             | movsx               eax, byte ptr [esi + eax]

        $sequence_25 = { 0f849e000000 833e00 0f8595000000 6a44 e8???????? }
            // n = 5, score = 100
            //   0f849e000000         | je                  0xa4
            //   833e00               | cmp                 dword ptr [esi], 0
            //   0f8595000000         | jne                 0x9b
            //   6a44                 | push                0x44
            //   e8????????           |                     

    condition:
        7 of them
}

Download all Yara Rules

Ryuk Propose Change

References

Yara Rules

Ryuk