Ransom.Ryuk

Short bio

Ransom.Ryuk is Malwarebytes’ detection name for a type of ransomware that is used in targeted attacks against enterprises and organizations.

Type and source of infection

Ransomware is a category of malware that holds files or systems hostage for ransom.

Ransom.Ryuk is used in targeted attacks, where the threat actors make sure that essential files are encrypted so they can ask for large ransom amounts. This means the attackers first find a way into the networks and use tools to map them out.

Aftermath

Because of the targeted nature of this ransomware, it is advised to do a full network scan to find any backdoors or other tools that the threat actors may have left behind, and which may enable them to regain access to the network.

Protection

Malwarebytes protects business and home users from Ransom.Ryuk by using Anti-Ransomware technology and real-time protection.

Malwarebytes blocks Ransom.Ryuk

Business remediation

Malwarebytes can detect and remove Ransom.Ryuk on business machines without further user interaction.

To remove Ransom.Ryuk using Malwarebytes business products, follow the instructions below.

How to remove Ransom.Ryuk with Malwarebytes Endpoint Protection

1. Go to the Malwarebytes Cloud console.
2. To allow you to invoke a scan while the machine is off the network, go to Settings > Policies > your policy > General.
3. Under Endpoint Interface Options, turn ON:
   1. Show Malwarebytes icon in notification area
   2. Allow users to run a Threat Scan (all threats will be quarantined automatically)
4. Temporarily enable Anti-Rootkit scanning for all invoked threat scans.
   Go to Settings > Policies > your policy > Endpoint Protection > Scan Options
5. Set Scan Rootkits to ON.
   
6. Once the endpoint has been updated with the latest policy changes:
   1. Take the client off the network
   2. From the system tray icon, run an Anti-Rootkit threat scan.
      

If you have infected machines that are not registered endpoints in Malwarebytes Endpoint Protection, you can remove Ransom.Ryuk with our Breach Remediation tool (MBBR).

1. Log into your My Account page and copy your license key. The key is needed to activate MBBR tool.
2. Open your Cloud console.
3. From a clean and safe machine, go to Endpoints > Add > Malwarebytes Breach Remediation. This will download the MBBR zip package.
4. Unzip the package.
5. Access a Windows command line prompt and issue the following commands:
   mbbr register –key:<prodkey>
   mbbr update
   Note: You must substitute your license key for <prodkey>.
6. Copy the MBBR folder to a flash drive.
7. From an infected, offline machine, copy the MBBR folder from the flash drive.
8. Start a scan using the following command:
   mbbr scan –full –ark –remove –noreboot
9. Refer to the Malwarebytes Breach Remediation Windows Administrator Guide for all supported scanning commands.

Home remediation

On non-networked systems Malwarebytes can detect and remove Ransom.Ryuk without further user interaction.

1. Please download Malwarebytes to your desktop.
2. Double-click MBSetup.exe and follow the prompts to install the program.
3. When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen.
4. Click on the Get started button.
5. Click Scan to start a Threat Scan.
6. Click Quarantine to remove the found threats.
7. Reboot the system if prompted to complete the removal process.

Traces/IOCs

Files:
RyukReadMe.html
RyukReadMe.txt

SHA256 hashes:
cfdc2cb47ef3d2396307c487fc3c9fe55b3802b2e570bee9aea4ab1e4ed2ec28
1455091954ecf9ccd6fe60cb8e982d9cfb4b3dc8414443ccfdfc444079829d56
3c037dcc0145a331e0154e016e0636d7f77be792d2d698b3b982fab33acc242a
85d9b9e22f6b8e1f1d6a56d219d7c4d486b72657834050ce7652792536d0c8e3
0b1008d91459937c9d103a900d8e134461db27c602a6db5e082ab9139670ccb6

BTC wallets:
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
1Ff4ZxANNtDuvL5Y95aGukJs3dgnuSrfTv
1LKULheYnNtJXgQNWM024MeLrBBCouECH7
15FC73BdkpDMUWmxo7e7gtLRtM8gQgXyb4
14dpmsn9rmdcS4dKD4GeqY2dYY6pwu4nVV
15RLWdVnY5n1n7mTvU1zjg67wt86dhYqNj