պ�9�����Q�]�9���d��?�hg+\�1T��S��~^�F��\��c�3˷~;uMbv~�(u5��:��_����tGٗ��5dz�UFs��YN�p��9�:�~:0 ��7lf�lQc��[�`]��_bU���2 y�m�J��`�U�B����k�d�4���'��槅�ژ����|��lV�E�a�|�:;hjEؙd�����)��)\��} ����={"����JW��J�2M1�t7zR�&O�0��Ч>,~�Hx ��l��B�V��v ���Y���n��z`O�<5� ����w�-����[M�C��d�J�tIM�[���!Hh�kc���ˈ��qd�Ү"��E�'H����=�cCr�fd�6���:H�^���p,����<�S(��G�O�4��Rgx%Qg�i��lЌ+jЕ���զt(n�ӽ(�����Uh�O_���?��/����Bgx������.���7ȓ���K2KfD''��g�X���ʄR���,��E�;h&g��,�H֮hO6� z|"0Mm�'�%9������dw%�EWf(-6���YX���U@�u6=��0�Z��믩mUݝ��~�/9m�s�O�;;k'6H��M��.����]��������ku��[�]�J�y�d�'3� �7�-4ǭuV�g��b�o�C�T0Q�]�KзC���� j� p��]����&A�� �M.f�:���ɯ�h7��?�0��jdNFD�P?�R!�/�S���ڣ"F2�a���p�.��%e�X^9t{'Q:<g���8��� �+2�� �'�i�U#˰m�2y{X�ą P�g� ���+��_^��������1҈��mg�q�I��0K��3!�9��?�p�1�}!"u٥��K զ��)a:����.��7�I)�Q�����)z+�R��B��I{a��ਖ਼�yjR�k0��Ͷ�������K���>\���-���0t{�a���������X�D�E�5�SU���ZH��p0sT�ю呴�=by���P�{����P�����`����2���<[ $u�9m�~���=2�Խn� ���z#�����:��o��윴����o���!H����n���D�ٌ} '�5��<�ؚ����n��^��?�VF�������C�=��]+���53=�.�q��J_��ah?�K�H�}��ZJv2n�iф�$��m8Z��Hӝ�`&��7e��hb �:�݇�ҕ �n�ۤB\p�O�,HB�v5�J�t���~c�^}�lq�x" C0�V�{�zl(w�CkT�j����* E�*�J�0A3�n�����l����H��l�g@���!aU�UtY�]�M�����:1lw�X�m���1��A��T�����W۪��d�:?�EK��3�'��C'��{B�����(b� "���̢�;WTd�NI w��G;'ڥ�~�aA�/D�"���s��~7t����-��s?L��&�Mu,v&)�oZh���OWi�@�JA!{�p�R����hF��R��~�4=<!|w���'�����3ϖr�Ңrod��k��^���C�fB�P�Q����$�F��j�{p�嚝�����s�$������*o���2'�J�_���K�l�]z���'�oY7�aG����|��"z�k3rz�����]�?�'r����uW��j�_p�kq��Cփ��>;����|}]�:>��/�Gwn���G����� �Rّ�n�Uz)�G���6]I��8s�Ԭ�Dsz�� ��'K �䛧����S{O�/��l6Gc��)�����a{��p�����~������ʷ��m���E�z�LL\��������*ql�Y|��zX�����;�%���$ �F;�kY�(�6�$���� �RRT�;�F)�C�lPKG�Is�U�&��U�H�˵Z��gJ���y�8����xi��:1�?�[�1�TM���¹m��_��H.TP��4V�w�g��������F�\��zEȃ��n�Ə ~�K1��i�K͡ln`X���o-wX ��:�{�y:Bж�(�6�����F�t�� � �j�2x���(,�MuRZIn������P/��c���u϶&u�+}��Q��|N����� �We(5xe�X�B4L�i�-S�Bmn����U�|��~5���<^�d� x� P�ͰRY���98��hɭ(P�1l�����`W�]W�D±V>7ڠ�!�7qķ?gt�sOsչ�n�an�/�g9(�z�Ϫ��V �i�2RD,�WF����� � β��G5f��kJ�~�<z~L��D�����7O�W�⺛^U*b�a��x��͝��(�Zt�~5������I�I���d�LF����LH����I���&�����.��vu[W�h�d���l?_�f��%,�5~;<�4�DeC?�;����L�RAys��=�:�z�V����Ŏ�w�7[*��l�0G"�Kg�>���nZ���?��v� �G ���C��ՋU+�Cn�+���Z���)C���oGʅ�9\]U �����F��P>�>F6��1�QE Pb���t���x^T 0�g��&�f����=��%�7���; �H���� x� jEwu�kpF%o�[Й-�������U)F}nK|F��P�,�d����Q]���ʽˮ���ϖ�}Y1*_�w|��:`�\6� ~���cpg����/�b�iA���ox�U�]r��w���/��?��κK�Ά_#H��o_=}Z"�]�T��t!�3�(-�Cg�8����z�:W��_ފͬ^?�Mnj�T���SN\.�eٹ�A�~0���T�7c������#���T�v'I�my7zM�^8����W��K�gk��*�l�42v�h���?��:����"$���MM@�j������{^�^���ԯ��̖�iC(m�=P$�n�f:�+�W����qe!kp��4b��AB�,]�.�vL[J�Ԩ߰ߠ���)�i� ��7�ϟ4f���o��53զ�2��8|"�'q y�q��'���;D�"p���CO�u���:])
Static task
static1
Behavioral task
behavioral1
Sample
ruyzaq.exe
Resource
win10v2004-20230220-en
General
-
Target
ruyzaq.exe
-
Size
7.9MB
-
MD5
f5fe2bb0a0900a6ff6a7759721465b60
-
SHA1
e99052a32c6a2a440155106084d7e1debaae03b9
-
SHA256
9075557595a0cccbba1ba9fdd09163cc4b2f8283df1277ea2fe131e141148a1a
-
SHA512
9cdd381c1011cd0d7601bb46075d277269e742814f96f2d77dcd52d5d61bf2f55d82e6476324f3e9ad21a518452b8234f4b14380d1dd78c73d9dd3e99910287a
-
SSDEEP
196608:N1sIZki/uxwQhTS+Wpb37BuTns3PFZZWwgD5vgxyQNH+h5SY87S:N5juxrJmz7ATns30wgtvgxyQNHM5H87S
Malware Config
Signatures
Files
-
ruyzaq.exe.exe windows x64
c2a3e0ed405c2e3833884300441c1aa0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
AreFileApisANSI
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
GetCurrentHwProfileA
user32
FindWindowA
CharUpperBuffW
msvcp140
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
ws2_32
WSACleanup
vcruntime140
_CxxThrowException
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-heap-l1-1-0
_aligned_free
api-ms-win-crt-runtime-l1-1-0
__p___argc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-string-l1-1-0
strcmp
Exports
Exports
Sections
.text Size: - Virtual size: 329KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 110KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.retplne Size: - Virtual size: 140B
.tls Size: - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.8"~ Size: - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.~E1 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.1aH Size: 7.9MB - Virtual size: 7.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 422B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ