Static task
static1
Behavioral task
behavioral1
Sample
Ruthenium.exe
Resource
win10v2004-20230220-en
General
-
Target
Ruthenium.exe
-
Size
36KB
-
MD5
a1f174ce74dbe0e84e2c2964b29de0fd
-
SHA1
d4dd4b86ec50b2ea2519f5472642d30301e20aa3
-
SHA256
5066c3a750eb6f07addf5cee1e6b00894c52e1c4fbf1702befcd5ac9bf1d83f3
-
SHA512
41edeab57b55b74a22ac46814f985a78704b35c14d330d5264765ce9a22d19762659a47cfce13fcef28f322ed0a018976585dd65270690422b64b4860a2ecd31
-
SSDEEP
384:x6j2tyffbHj9X8EY5Z3absnexUDoRGAGYk2zWfAozcQcgJgyBkAg+jdGb90kGj:SDD9hYbqbhFZkeWoecuiATjXp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Ruthenium.exe
Files
-
Ruthenium.exe.exe windows x86
Password: infected
97e2ab48f6848634cf4b4b58616e1785
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
gdi32
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateRoundRectRgn
CreateSolidBrush
InvertRgn
PatBlt
PlgBlt
SelectObject
SetBkColor
SetTextColor
StretchBlt
TextOutW
kernel32
AddAtomA
CloseHandle
CreateFileW
CreateThread
ExitProcess
FindAtomA
FreeConsole
GetAtomNameA
SetUnhandledExceptionFilter
Sleep
TerminateThread
WinExec
WriteFile
msvcrt
__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
abort
atexit
fflush
fprintf
free
malloc
rand
signal
system
wcslen
user32
DrawIcon
GetCursorPos
GetDC
GetDesktopWindow
GetSystemMetrics
GetWindowRect
LoadIconA
MessageBoxA
RedrawWindow
winmm
waveOutClose
waveOutOpen
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutWrite
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 176B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE