2024-01-11_5d1d3b197510c15855c00fef6b1bdb9b_ryuk

Sharing

Copy URL

Twitter E-mail

General

Target

2024-01-11_5d1d3b197510c15855c00fef6b1bdb9b_ryuk
Size

15.6MB
MD5

5d1d3b197510c15855c00fef6b1bdb9b
SHA1

07c7e9b4762ced21727e712aacf38f503589a081
SHA256

e1223e8264f940af46be6b5108e6f069a9deb484c1d0532db17231d809b437d5
SHA512

53c90b4d15f346daaf46840f023868a0482a8d962aea1724387c4abba4f8120ee02dbf3fb6144728730be63ecf33f38918b92c896cfda24483cfb87535e082aa
SSDEEP

196608:g8Ybslg76rYKAR66zhAGaUO12ACKyag7mR3iJGWxspm8nCyJ:g8GadrYvR1zhAhU/paZ3ouBC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-01-11_5d1d3b197510c15855c00fef6b1bdb9b_ryuk

Files

2024-01-11_5d1d3b197510c15855c00fef6b1bdb9b_ryuk
.exe windows:6 windows x64 arch:x64

6fa6680a74763ca6820c8ae8d63cbdee

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VirtualAlloc
GetVersionExW
UnregisterWait
SetThreadAffinityMask
GetProcessAffinityMask
VirtualFree
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SwitchToThread
SignalObjectAndWait
DeleteTimerQueueTimer
VirtualProtect
RegisterWaitForSingleObject
UnregisterWaitEx
QueryDepthSList
InterlockedPopEntrySList
ReleaseSemaphore
GetModuleHandleA
GetThreadTimes
CreateTimerQueue
WriteConsoleW
ReadConsoleW
HeapSize
GetTimeZoneInformation
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
TzSpecificLocalTimeToSystemTime
HeapReAlloc
GetCurrentDirectoryA
GetSystemTime
SystemTimeToFileTime
SetFileAttributesA
CloseHandle
CreateFileA
CopyFileA
SetFileTime
FreeLibraryAndExitThread
ExitThread
HeapFree
GetCurrentDirectoryW
MoveFileA
WideCharToMultiByte
FindClose
GetNumaHighestNodeNumber
FindFirstFileA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
MultiByteToWideChar
FormatMessageW
GetStringTypeW
CreateDirectoryW
CreateFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
SetEndOfFile
SetFilePointerEx
GetTempPathW
GetLastError
AreFileApisANSI
QueryPerformanceFrequency
TryEnterCriticalSection
DuplicateHandle
Sleep
GetCurrentThread
GetExitCodeThread
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
FindFirstFileW
GetFileAttributesW
GetFullPathNameW
GetTempFileNameW
GetVolumePathNameW
GetModuleFileNameW
SizeofResource
FindResourceW
FileTimeToSystemTime
LoadResource
LockResource
SetCurrentDirectoryW
WaitForSingleObject
WriteFile
LocalFree
GetFileSizeEx
ReadFile
FreeLibrary
LoadLibraryW
GetCommandLineW
OutputDebugStringW
SleepEx
InitializeCriticalSection
HeapCreate
HeapDestroy
HeapAlloc
CreateThread
SuspendThread
ResumeThread
GlobalAlloc
GlobalLock
GlobalUnlock
OutputDebugStringA
GetLocalTime
CancelIoEx
ReadDirectoryChangesW
GetVolumeInformationW
GetWindowsDirectoryW
LocalAlloc
GetComputerNameW
ExitProcess
InitializeCriticalSectionEx
InitializeConditionVariable
WakeConditionVariable
SleepConditionVariableCS
SetThreadPriority
LoadLibraryA
CreateEventA
RtlPcToFileHeader
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
LoadLibraryExW
RtlUnwindEx
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
GetModuleHandleExW
GetStdHandle
SetEnvironmentVariableW

user32

MessageBoxW
SetWindowPos
GetWindowRect
FindWindowW
EnumDisplayMonitors
GetSystemMetrics
PostMessageW
wsprintfW
GetKeyboardState
GetMouseMovePointsEx
ReleaseCapture
SetCapture
CloseTouchInputHandle
GetTouchInputInfo
PostQuitMessage
SetCursor
SetCursorPos
FillRect
GetWindowThreadProcessId
RegisterTouchWindow
AttachThreadInput
IsClipboardFormatAvailable
EmptyClipboard
GetClipboardData
SetClipboardData
GetClipboardSequenceNumber
CloseClipboard
ClipCursor
ClientToScreen
ScreenToClient
TranslateMessage
DispatchMessageW
PeekMessageW
DefWindowProcW
UnregisterClassW
RegisterClassExW
CreateWindowExW
DestroyWindow
ShowWindow
UpdateLayeredWindow
UpdateWindow
GetDC
ReleaseDC
LoadCursorW
LoadIconW
WaitForInputIdle
SendMessageW
GetWindowPlacement
SetActiveWindow
GetForegroundWindow
SetForegroundWindow
ValidateRect
SetWindowTextW
AdjustWindowRect
AdjustWindowRectEx
GetCursorPos
SetWindowLongPtrW
DestroyIcon
CreateIconIndirect
ChangeDisplaySettingsW
OpenClipboard

advapi32

ConvertSidToStringSidW
GetUserNameA
RegCloseKey
RegQueryValueExW
LookupAccountNameW
GetUserNameW
RegOpenKeyExW

shell32

SHGetKnownFolderPath
SHCreateItemFromParsingName
ShellExecuteA
ShellExecuteW
SHFileOperationW
CommandLineToArgvW
SHAppBarMessage
DragAcceptFiles
DragFinish
DragQueryPoint
DragQueryFileW

tag

??1String@TagLib@@UEAA@XZ
?toWString@String@TagLib@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
??0FileName@TagLib@@QEAA@PEB_W@Z
??0FileRef@TagLib@@QEAA@VFileName@1@_NW4ReadStyle@AudioProperties@1@@Z
??1FileRef@TagLib@@UEAA@XZ
?tag@FileRef@TagLib@@QEBAPEAVTag@2@XZ

steam_api64

SteamAPI_UnregisterCallback
SteamAPI_RegisterCallback
SteamInternal_FindOrCreateUserInterface
SteamAPI_RunCallbacks
SteamInternal_ContextInit
SteamAPI_Shutdown
SteamAPI_RestartAppIfNecessary
SteamAPI_Init
SteamAPI_GetHSteamUser

winmm

mmioClose
mmioRead
mmioSeek
midiOutGetNumDevs
midiOutGetDevCapsW
midiOutOpen
midiOutClose
mmioOpenW
midiOutUnprepareHeader
midiOutShortMsg
midiOutLongMsg
joyGetPosEx
joyGetNumDevs
joyGetDevCapsW
midiOutPrepareHeader
waveInReset
timeGetTime
waveInStart
waveInAddBuffer
waveInPrepareHeader

gdiplus

GdipAlloc
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdiplusStartup
GdiplusShutdown
GdipSaveImageToStream
GdipGetImageEncoders
GdipFree
GdipGetImageEncodersSize
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipGetPropertyItem
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize

shlwapi

ord12
ord184
ord214
ord219
PathFileExistsA

avifil32

AVIStreamRelease
AVIStreamSetFormat
AVIFileOpenW
AVIFileRelease
AVIFileExit
AVIFileInit
AVIStreamWrite
AVIMakeCompressedStream
AVIFileCreateStreamW

ws2_32

gethostbyname
WSAStartup
WSACleanup
gethostname

wininet

InternetGetConnectedState

imm32

ImmReleaseContext
ImmSetCompositionFontW
ImmGetContext
ImmSetCompositionWindow

gdi32

CreateCompatibleDC
DeleteDC
DeleteObject
CreateFontIndirectW
TextOutW
StrokeAndFillPath
EndPath
BeginPath
GetTextMetricsW
SetBkMode
RemoveFontMemResourceEx
AddFontMemResourceEx
RemoveFontResourceExW
AddFontResourceExW
GetGlyphOutlineW
CreateSolidBrush
CreatePen
GetObjectW
SetPixel
GetDIBits
CreateCompatibleBitmap
CreateBitmap
CreateDIBSection
SelectObject
GetStockObject

comdlg32

GetSaveFileNameW
ChooseColorW
ChooseFontW
GetOpenFileNameW

ole32

CoCreateInstance
PropVariantClear
CreateStreamOnHGlobal
CoInitializeEx
CoUninitialize
CoTaskMemFree

Exports

Exports

AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
opus_decode
opus_decode_float
opus_decoder_create
opus_decoder_ctl
opus_decoder_destroy
opus_decoder_get_nb_samples
opus_decoder_get_size
opus_decoder_init
opus_encode
opus_encode_float
opus_encoder_create
opus_encoder_ctl
opus_encoder_destroy
opus_encoder_get_size
opus_encoder_init
opus_get_version_string
opus_multistream_decode
opus_multistream_decode_float
opus_multistream_decoder_create
opus_multistream_decoder_ctl
opus_multistream_decoder_destroy
opus_multistream_decoder_get_size
opus_multistream_decoder_init
opus_multistream_encode
opus_multistream_encode_float
opus_multistream_encoder_create
opus_multistream_encoder_ctl
opus_multistream_encoder_destroy
opus_multistream_encoder_get_size
opus_multistream_encoder_init
opus_multistream_packet_pad
opus_multistream_packet_unpad
opus_multistream_surround_encoder_create
opus_multistream_surround_encoder_get_size
opus_multistream_surround_encoder_init
opus_packet_get_bandwidth
opus_packet_get_nb_channels
opus_packet_get_nb_frames
opus_packet_get_nb_samples
opus_packet_get_samples_per_frame
opus_packet_pad
opus_packet_parse
opus_packet_unpad
opus_pcm_soft_clip
opus_repacketizer_cat
opus_repacketizer_create
opus_repacketizer_destroy
opus_repacketizer_get_nb_frames
opus_repacketizer_get_size
opus_repacketizer_init
opus_repacketizer_out
opus_repacketizer_out_range
opus_strerror

Sections

.text
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 111KB - Virtual size: 837KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 198KB - Virtual size: 198KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gehcont
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8.7MB - Virtual size: 8.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6fa6680a74763ca6820c8ae8d63cbdee

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

tag

steam_api64

winmm

gdiplus

shlwapi

avifil32

ws2_32

wininet

imm32

gdi32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 4.5MB - Virtual size: 4.5MB

.rdata Size: 2.1MB - Virtual size: 2.1MB

.data Size: 111KB - Virtual size: 837KB

.pdata Size: 198KB - Virtual size: 198KB

.gfids Size: 4KB - Virtual size: 4KB

.tls Size: 3KB - Virtual size: 2KB

.gehcont Size: 512B - Virtual size: 36B

_RDATA Size: 6KB - Virtual size: 6KB

.rsrc Size: 8.7MB - Virtual size: 8.7MB

.reloc Size: 31KB - Virtual size: 30KB

.text
Size: 4.5MB - Virtual size: 4.5MB

.rdata
Size: 2.1MB - Virtual size: 2.1MB

.data
Size: 111KB - Virtual size: 837KB

.pdata
Size: 198KB - Virtual size: 198KB

.gfids
Size: 4KB - Virtual size: 4KB

.tls
Size: 3KB - Virtual size: 2KB

.gehcont
Size: 512B - Virtual size: 36B

_RDATA
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 8.7MB - Virtual size: 8.7MB

.reloc
Size: 31KB - Virtual size: 30KB