2024-01-10_743b5233534ea58f35c1019b34355647_ryuk

Sharing

Copy URL

Twitter E-mail

General

Target

2024-01-10_743b5233534ea58f35c1019b34355647_ryuk
Size

12.7MB
MD5

743b5233534ea58f35c1019b34355647
SHA1

56abfbf4cab6dee18a27ee3fed2b4a7f1e8e4d21
SHA256

e7dffd5c9886f72e10b75f70fc467f0630fc8e34a5623b8062154534893dbc45
SHA512

07e3fe7c8173aa603aad130fb366e2279efffed3d81dc7453486dbb924ef84ff05ce7db47fa3434f78bc405f590d36b52b6f10a30a3fde8cc56b46c53fd47ab9
SSDEEP

98304:G9bJrxkHb3Wi1JO+SGCYD1ntzMYiWNWRF+2LprjhlCPdEdZOf:G9bJrwKiLSG51ZKe

Score

1^/10

Malware Config

Signatures

Files

2024-01-10_743b5233534ea58f35c1019b34355647_ryuk
.exe windows:5 windows x64 arch:x64

a458fd7a5bab52d785141e669260f12b

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:f7:4e:68:b8:19:7a:cb:17:aa:18:42:39:28:b3:7f
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

19-09-2023 00:00

Not After

18-09-2026 23:59

Subject

CN=Bitvise Limited,O=Bitvise Limited,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:f7:4e:68:b8:19:7a:cb:17:aa:18:42:39:28:b3:7f
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

19-09-2023 00:00

Not After

18-09-2026 23:59

Subject

CN=Bitvise Limited,O=Bitvise Limited,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d8:0a:00:90:df:c8:2c:8c:88:1b:0d:45:34:e1:05:a7:c5:93:36:2b:3f:10:77:76:28:a3:9c:7c:45:34:39:41
Signer

Actual PE Digest

d8:0a:00:90:df:c8:2c:8c:88:1b:0d:45:34:e1:05:a7:c5:93:36:2b:3f:10:77:76:28:a3:9c:7c:45:34:39:41

Digest Algorithm

sha256

PE Digest Matches

true

76:9e:a4:9f:4f:f3:08:44:28:98:e0:f6:9e:a5:88:b2:19:71:9e:d8
Signer

Actual PE Digest

76:9e:a4:9f:4f:f3:08:44:28:98:e0:f6:9e:a5:88:b2:19:71:9e:d8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetNumberFormatW
OpenEventW
ExpandEnvironmentStringsW
ReadConsoleW
WriteConsoleW
GetFileSizeEx
ReadFile
IsDebuggerPresent
DebugBreak
GetModuleFileNameA
ExitProcess
InitializeCriticalSection
EnterCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
FreeLibrary
VerSetConditionMask
GetSystemDirectoryW
LocalFree
lstrlenW
FormatMessageW
GetModuleHandleW
VirtualQueryEx
VirtualFree
GetModuleHandleExW
GetModuleFileNameW
GetFileAttributesW
CreateThread
OutputDebugStringA
CreateFileA
WriteFile
RtlCaptureStackBackTrace
CompareStringW
GetTempPathW
GetFullPathNameW
GetLongPathNameW
GetWindowsDirectoryW
GetCurrentDirectoryW
GetComputerNameExW
GetEnvironmentVariableW
GetDiskFreeSpaceW
GetDiskFreeSpaceExW
GetVolumePathNameW
LoadLibraryExW
GetCurrentThread
LocalAlloc
LocalSize
FindClose
MulDiv
SystemTimeToFileTime
DeleteFileW
FlushFileBuffers
SetFilePointerEx
SetEndOfFile
SetFilePointer
FoldStringW
GetSystemDirectoryA
GetSystemTimeAsFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CreateDirectoryW
QueryPerformanceFrequency
QueryPerformanceCounter
GetLogicalDriveStringsW
QueryDosDeviceW
FindFirstVolumeW
GetVolumePathNamesForVolumeNameW
FindNextVolumeW
GetFileInformationByHandle
FindVolumeClose
ConvertThreadToFiber
ConvertFiberToThread
CreateFiberEx
DeleteFiber
SwitchToFiber
OutputDebugStringW
GetSystemTime
GetOverlappedResult
ConnectNamedPipe
SetEnvironmentVariableW
CreateNamedPipeW
CancelIo
GetOEMCP
GetCPInfo
OpenEventA
CreateMutexA
OpenMutexA
CreateFileMappingA
OpenFileMappingA
CreateEventA
GetStringTypeW
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LCMapStringW
GetLocaleInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
WaitForSingleObjectEx
InitializeSListHead
RtlPcToFileHeader
RtlUnwindEx
InterlockedPushEntrySList
FreeLibraryAndExitThread
HeapAlloc
HeapReAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
HeapSize
GetProcessHeap
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
CopyFileW
Thread32Next
SuspendThread
Thread32First
VirtualAlloc
GetLocalTime
SleepEx
GetVolumeInformationW
CreateHardLinkW
MoveFileExW
RemoveDirectoryW
DeviceIoControl
UnlockFileEx
LockFileEx
GetLogicalDrives
WaitNamedPipeW
WaitForMultipleObjectsEx
SwitchToThread
DeleteCriticalSection
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
GetFileType
Sleep
GetConsoleCP
ReadProcessMemory
GetExitCodeThread
CreateRemoteThread
FlushInstructionCache
VirtualProtectEx
WriteProcessMemory
GetProcAddress
ExitThread
LoadLibraryW
VirtualAllocEx
VirtualFreeEx
GetConsoleCursorInfo
SetConsoleTitleW
Module32NextW
Module32FirstW
SetConsoleMode
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
AllocConsole
GetStartupInfoW
SetCurrentDirectoryW
ReadConsoleOutputA
WriteConsoleOutputCharacterW
CreateConsoleScreenBuffer
IsDBCSLeadByteEx
GetCPInfoExW
GetACP
ResumeThread
SetConsoleScreenBufferSize
GetConsoleWindow
GetConsoleFontSize
GetCurrentConsoleFont
SetHandleInformation
CreateProcessW
CreateFileMappingW
AttachConsole
SetStdHandle
DuplicateHandle
FreeConsole
GetCommandLineW
MapViewOfFile
UnmapViewOfFile
GetStdHandle
SetConsoleCtrlHandler
MultiByteToWideChar
OpenThread
WideCharToMultiByte
WriteConsoleOutputW
SetConsoleCursorPosition
ScrollConsoleScreenBufferW
SetConsoleWindowInfo
GetCurrentThreadId
CreateFileW
ReadConsoleOutputW
WaitForMultipleObjects
ReadConsoleInputW
GetConsoleScreenBufferInfo
GetConsoleOutputCP
ReleaseMutex
AddConsoleAliasW
GetConsoleAliasesW
GetConsoleAliasesLengthW
GetConsoleAliasW
CreateMutexW
GetConsoleMode
GenerateConsoleCtrlEvent
ResetEvent
WriteConsoleInputW
GetNumberOfConsoleInputEvents
CreateEventW
SetEvent
SetLastError
GetExitCodeProcess
GetCurrentProcess
GetCurrentProcessId
TerminateThread
GetTickCount
TerminateProcess
OpenProcess
WaitForSingleObject
GetLastError
CloseHandle
LoadLibraryA

user32

GetPropA
RemovePropA
GetDC
ReleaseDC
CharUpperW
MapVirtualKeyW
GetSystemMetrics
VkKeyScanW
CallWindowProcW
MapDialogRect
FindWindowW
CharLowerW
DestroyIcon
CharLowerBuffW
MessageBoxW
SendMessageW
wsprintfA
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
wsprintfW

secur32

AcquireCredentialsHandleW
AcquireCredentialsHandleA
AcceptSecurityContext
InitializeSecurityContextA
InitializeSecurityContextW
FreeContextBuffer
EnumerateSecurityPackagesA
QuerySecurityPackageInfoA
VerifySignature
MakeSignature
FreeCredentialsHandle
DeleteSecurityContext

ws2_32

inet_addr
gethostbyname
getservbyport
WSACleanup
WSAStartup
getservbyname
htons
gethostbyaddr
WSAGetLastError
inet_ntoa
WSASetLastError
ntohl
WSAStringToAddressW
htonl
ntohs
getpeername
shutdown
closesocket
WSAEnumProtocolsW
WSASocketW
WSCGetProviderPath
setsockopt
bind
getsockname
accept
ioctlsocket
WSAEventSelect
connect
WSAEnumNetworkEvents
WSAGetOverlappedResult
WSARecv
WSASend
listen

gdi32

GetDeviceCaps
DeleteDC

advapi32

GetUserNameW
CryptDestroyKey
RegNotifyChangeKeyValue
SetSecurityInfo
ConvertStringSidToSidW
GetAce
DecryptFileW
EncryptFileW
GetTokenInformation
AdjustTokenPrivileges
LookupPrivilegeValueW
GetSecurityDescriptorControl
SetSecurityDescriptorControl
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
GetAclInformation
AddAuditAccessAceEx
AddAccessDeniedAceEx
AddAccessAllowedAceEx
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
GetSecurityInfo
GetNamedSecurityInfoW
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
EqualSid
GetLengthSid
CopySid
GetSidLengthRequired
InitializeSid
LookupAccountNameW
LookupAccountSidW

ole32

CoTaskMemAlloc
CoTaskMemFree

psapi

GetModuleInformation

crypt32

CryptProtectData
CryptUnprotectData

iphlpapi

GetTcpTable

Sections

.text
Size: 8.0MB - Virtual size: 8.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 227KB - Virtual size: 255KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 267KB - Virtual size: 267KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 305B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a458fd7a5bab52d785141e669260f12b

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

62:f7:4e:68:b8:19:7a:cb:17:aa:18:42:39:28:b3:7fCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

62:f7:4e:68:b8:19:7a:cb:17:aa:18:42:39:28:b3:7fCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

d8:0a:00:90:df:c8:2c:8c:88:1b:0d:45:34:e1:05:a7:c5:93:36:2b:3f:10:77:76:28:a3:9c:7c:45:34:39:41Signer

76:9e:a4:9f:4f:f3:08:44:28:98:e0:f6:9e:a5:88:b2:19:71:9e:d8Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

secur32

ws2_32

gdi32

advapi32

ole32

psapi

crypt32

iphlpapi

Sections

.text Size: 8.0MB - Virtual size: 8.0MB

.rdata Size: 4.2MB - Virtual size: 4.2MB

.data Size: 227KB - Virtual size: 255KB

.pdata Size: 267KB - Virtual size: 267KB

.tls Size: 512B - Virtual size: 305B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 53KB - Virtual size: 52KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

62:f7:4e:68:b8:19:7a:cb:17:aa:18:42:39:28:b3:7f
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

62:f7:4e:68:b8:19:7a:cb:17:aa:18:42:39:28:b3:7f
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

d8:0a:00:90:df:c8:2c:8c:88:1b:0d:45:34:e1:05:a7:c5:93:36:2b:3f:10:77:76:28:a3:9c:7c:45:34:39:41
Signer

76:9e:a4:9f:4f:f3:08:44:28:98:e0:f6:9e:a5:88:b2:19:71:9e:d8
Signer

.text
Size: 8.0MB - Virtual size: 8.0MB

.rdata
Size: 4.2MB - Virtual size: 4.2MB

.data
Size: 227KB - Virtual size: 255KB

.pdata
Size: 267KB - Virtual size: 267KB

.tls
Size: 512B - Virtual size: 305B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 53KB - Virtual size: 52KB