{"id":123847,"date":"2021-07-06T21:01:34","date_gmt":"2021-07-07T04:01:34","guid":{"rendered":"\/blogs\/?p=123847"},"modified":"2024-02-19T00:31:02","modified_gmt":"2024-02-19T08:31:02","slug":"new-ryuk-ransomware-sample%e2%80%aftargets-webservers","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-ryuk-ransomware-sample%e2%80%aftargets-webservers\/","title":{"rendered":"New Ryuk Ransomware Sample\u202fTargets Webservers"},"content":{"rendered":"

Executive Summary<\/h2>\n

Ryuk<\/a> is a ransomware that encrypts a victim\u2019s files and requests payment in Bitcoin cryptocurrency to release the keys used for encryption. Ryuk is used exclusively in targeted ransomware attacks.<\/p>\n

Ryuk was first observed in August 2018 during a campaign that targeted several enterprises. Analysis of the initial versions of the ransomware revealed similarities and shared source code with the Hermes ransomware<\/a>. Hermes ransomware is a commodity malware for sale on underground forums and has been used by multiple threat actors.<\/p>\n

To encrypt files Ryuk utilizes a combination of symmetric AES (256-bit) encryption and asymmetric RSA (2048-bit or 4096-bit) encryption. The symmetric key is used to encrypt the file contents, while the asymmetric public key is used to encrypt the symmetric key. Upon payment of the ransom the corresponding asymmetric private key is released, allowing the encrypted files to be decrypted.<\/p>\n

Because of the targeted nature of Ryuk infections, the initial infection vectors are tailored to the victim. Often seen initial vectors are spear-phishing emails, exploitation of compromised credentials to remote access systems and the use of previous commodity malware infections. As an example of the latter, the combination of Emotet and TrickBot, have frequently been observed in Ryuk attacks.<\/p>\n

Coverage and Protection Advice<\/h2>\n

Ryuk is detected as Ransom-Ryuk![partial-hash].<\/p>\n

Defenders should be on the lookout for traces and behaviours that correlate to\u202fopen source\u202fpen test tools such as\u202fwinPEAS,\u202fLazagne, Bloodhound and Sharp Hound, or hacking frameworks like Cobalt Strike, Metasploit, Empire or Covenant, as well as abnormal\u202fbehavior\u202fof non-malicious tools that have a dual use. These seemingly legitimate tools (e.g.,\u202fADfind,\u202fPSExec, PowerShell, etc.) can be used for things like enumeration and execution. Subsequently, be on the lookout for abnormal usage of Windows Management Instrumentation WMIC (T1047). We advise everyone to check out the following blogs on evidence indicators for a targeted ransomware attack (Part1<\/a>,\u202fPart2<\/a>).<\/p>\n