After the release of Chaos Ransomware Builder v5, its sixth iteration had yet another re-branding, this time being renamed Yashma. The Relight films are a condensed version of the anime series. The premise of the films is that Ryuk tells the story to a fellow Shinigami. Ryuk does not encrypt files from within its own process memory space, but injects into a remote process. Before injecting into a remote process, Ryuk attempts to adjust its token privileges to have the SeDebugPrivilege . It takes no action if the adjustment of the token privileges fails. Before injecting into a remote process, Ryuk also calls CreateToolhelp32Snapshot to enumerate all running processes. If a process is found that is not named csrss.exe , explorer.exe , lsaas.exe , or is running under NT AUTHORITY system account, Ryuk will inject itself into this single process. By ensuring that the process is not running under NT AUTHORITY , the developers are assuming the process is not running under another account and therefore can be written to. Ryuk uses a combination of VirtualAlloc , WriteProcessMemory and CreateRemoteThread to inject itself into the remote process. Process/Service Termination and Anti-Recovery Commands Sometime after Light's death and Ryuk's return to the Shinigami Realm, Ryuk becomes popular among other Shinigami due to his time spent in the Human World with Light. Eventually, Ryuk's story catches the attention of an unnamed Shinigami, who visits Ryuk to hear it. Ryuk is a well-known ransomware variant, and different versions have been reviewed in the past. However, due to its targeted and ever-evolving nature, it is interesting to see what the latest variants hold in store.

If executed on a 64 bit system, it will append the string by adding “/reg:64” to the command. This exact persistence method was used by previous samples as well. Wake-up Network Devices

Appendix C - Terminated Processes

All humans die the same, the place they go after death isn't decided upon by a god it is Mu (nothingness). The malware can now also stop various services on the victim device. Based on our analysis of Yashma samples taken from the wild, these are the services we’ve seen the updated malware target:

In the film series, Ryuk is very similar to his canon self. The second film ends in much the same manner as the manga, except Ryuk pretends to be more cooperative by laughing together with Light over the fact that the Task Force can't shoot through his incorporeal form. Ryuk informs Light that humans who have used the Death Note are unable to enter either Heaven or Hell and shows Light his name written in the notebook. Light yells at Ryuk and jumps through him, trying in vain to stop his death, before dying in his father's arms. After Light's death, Ryuk asks L if he will to use the Death Note, and when L says that he won't, Ryuk calls L boring and flies away. He is last seen several months later, laughing and circling around Tokyo Tower. The Onyx group simply customized their ransom note and created a refined list of file extensions they wished to target. There is little other modification to differentiate it from any other samples built with Chaos v4.0. In other media Relight anime films Main articles: Death Note Relight 1: Visions of a God and Death Note Relight 2: L's Successors Five days later, Ryuk has a conversation with Light. The simple reason he gives about why he dropped the Death Note into the human world is that because he is bored. He then tells Light that, since he was the one who found the notebook, it belongs to him. If he does not need it anymore, he can pass it to anyone else. But when it is the time for Light to die, Ryuk will write his name down. Light then explains to Ryuk that he wishes to cleanse the world of evil criminals, and becomes the God of the new world. Ryuk tells Light that, if he were to do that, the only bad person left would be Light himself. Light ignores his comment, maintaining that he is entirely sincere. Ryuk then comments that humans are interesting.I was the whole thing, Taro. That was some pretty smart thinking. Hyuk hyuk hyuk. So how was it… the Land of the Dead?” ( Pilot chapter)

Process and service termination - Attempts to terminate processes and services that may interfere with its operationChaos (and subsequently Yashma) have seen rapid development and advances throughout the last year, with its most recent iteration, “Yashma” (Chaos v6.0), found in-the-wild in mid-2022.