Ryuk Defunct

rule Ryuk_Ransomware {
    meta:
        description = "Detects Ryuk ransomware"
        author = "Security Research"
    strings:
        $s1 = "RyukReadMe" ascii
        $s2 = "Gentlemen!" ascii
        $s3 = "UNIQUE_ID_DO_NOT_REMOVE" ascii
    condition:
        uint16(0) == 0x5A4D and 2 of them
}

Gentlemen!

Your business is at serious risk.
There is a significant hole in the security system of your company.
We've easily penetrated your network.
You should thank the Lord for being hacked by serious people not some stupid schoolboys or dangerous punks.
They can damage all your important data just for fun.

Now your files are crypted with the strongest military algorithms RSA4096 and AES-256.
No one can help you to restore files without our special decoder.

Photorec, RannohDecryptor etc. repair tools are useless and can destroy your files irreversibly.

If you want to restore your files write to emails (contacts are at the bottom of the sheet)
and attach 2-3 encrypted files (Less than 5 Mb each, non-archived and your files should not
contain valuable information (Databases, backups, large excel sheets, etc.)).
You will receive decrypted samples and our conditions how to get the decoder.
Please don't forget to write the name of your company in the subject of your e-mail.

No system is safe.

BTC wallet:
{BTC_WALLET}

Contacts:
{EMAIL1}
{EMAIL2}