Ransomware Research
RU_Ransom Ransomware
RU_Ransom is a malicious ransomware strain that encrypts victim files and demands ransom payment for decryption. First observed in the wild on February 1, 2022, this ransomware has been actively targeting systems worldwide. Security researchers also track this malware under the aliases: RURansom.
Quick Facts
- Ransomware Family
- RU_Ransom
- First Seen
- February 1, 2022
- Known Aliases
- RURansom
How RU_Ransom Ransomware Works
Targeted Files
979f9d1e019d9172af73428a1b3cbdff8aec8fdbe0f67cba48971a36f5001da9 -> doesn't change filenames, base64 contents
File Encryption Patterns
RU_Ransom modifies encrypted files using specific patterns to mark them as encrypted:
File extensions added after encryption:
..fs_invadeRansom Note and Payment Demands
After encrypting files, RU_Ransom displays ransom notes demanding payment for file recovery:
Полномасштабное_кибервторжение.txtRansom message:
notes/Полномасштабное_кибервторжение.txt
Note locations:
EveryFolderTechnical Indicators
Associated Executable Files
The following executable files are associated with RU_Ransom ransomware:
RURansom.exeRURansom.bin
Elastio Can Help You
Don't let RU_Ransom ransomware take over your data
Elastio provides advanced ransomware protection and recovery solutions to keep your organization safe.
About This Analysis
This RU_Ransom ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery solutions, helping organizations defend against and recover from ransomware attacks like RU_Ransom.
Last updated: July 30, 2025