2024-01-11_b023ba68bc478d807a61367d214b9d4c_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-01-11_b023ba68bc478d807a61367d214b9d4c_ryuk
Size

2.0MB
MD5

b023ba68bc478d807a61367d214b9d4c
SHA1

1ded21eda1899a2609f9fe0c35c8ffdbc1378e91
SHA256

80a9aa96f4956ce51cc3f6305b2a90d3fdf247660e506c11bdc735fbbdbcf473
SHA512

2efa6448eb4fe4a84b260812aae0333f450297522d62a95bc4c96c5f94d0400ccb235c61250d8d720a11723d7029b2fe3b70fe3a6fd0ce9984207babf27f35fb
SSDEEP

24576:VeY3Z6zPa1njQFFOs2Q2M3xLG2NdXFm6pW/JbnYAk:VeYp6zPa1OFOsxF8BnYl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-01-11_b023ba68bc478d807a61367d214b9d4c_ryuk

Files

2024-01-11_b023ba68bc478d807a61367d214b9d4c_ryuk
.exe windows:6 windows x64 arch:x64

736e907e0b79f092edf6ff61e5713963

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList

opencv_core310d

?deallocate@String@cv@@AEAAXXZ
?deallocate@Mat@cv@@QEAAXXZ
?fastFree@cv@@YAXPEAX@Z
?allocate@String@cv@@AEAAPEAD_K@Z
?zeros@Mat@cv@@SA?AVMatExpr@2@HHH@Z
?error@cv@@YAXHAEBVString@1@PEBD1H@Z
?zeros@Mat@cv@@SA?AVMatExpr@2@V?$Size_@H@2@H@Z
?create@Mat@cv@@QEAAXHPEBHH@Z
??4Mat@cv@@QEAAAEAV01@AEBV?$Scalar_@N@1@@Z

opencv_highgui310d

?waitKey@cv@@YAHH@Z
?namedWindow@cv@@YAXAEBVString@1@H@Z
?imshow@cv@@YAXAEBVString@1@AEBV_InputArray@1@@Z

opencv_videoio310d

?isOpened@VideoCapture@cv@@UEBA_NXZ
?read@VideoCapture@cv@@UEAA_NAEBV_OutputArray@2@@Z
?get@VideoCapture@cv@@UEBANH@Z
??0VideoCapture@cv@@QEAA@H@Z
??1VideoCapture@cv@@UEAA@XZ

kernel32

SetLastError
CreateFileW
GetTimeZoneInformation
GetConsoleCP
FlushFileBuffers
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileW
FindNextFileA
FindFirstFileExW
FindFirstFileExA
FindClose
SetFilePointerEx
ReadConsoleW
GetConsoleMode
CloseHandle
WaitForSingleObject
CreateEventW
QueryPerformanceCounter
QueryPerformanceFrequency
GetLastError
CreateFileA
DeviceIoControl
CreateEventA
GetOverlappedResult
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
GetModuleHandleW
GetProcAddress
IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
SetConsoleCtrlHandler
WriteConsoleW
OutputDebugStringW
OutputDebugStringA
FormatMessageW
EncodePointer
DecodePointer
SetEndOfFile
InitializeCriticalSectionAndSpinCount
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
LoadLibraryExW
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleFileNameW
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetModuleHandleExW
HeapSize
HeapValidate
GetSystemInfo
GetModuleFileNameA
ReadFile
ExitProcess
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetACP
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetCurrentThread
HeapReAlloc
HeapQueryInformation

user32

UnregisterDeviceNotification
RegisterDeviceNotificationA
MessageBoxA

Sections

.textbss
Size: - Virtual size: 714KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 367KB - Virtual size: 366KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 283B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

736e907e0b79f092edf6ff61e5713963

Headers

DLL Characteristics

File Characteristics

Imports

setupapi

opencv_core310d

opencv_highgui310d

opencv_videoio310d

kernel32

user32

Sections

.textbss Size: - Virtual size: 714KB

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 367KB - Virtual size: 366KB

.data Size: 10KB - Virtual size: 21KB

.pdata Size: 79KB - Virtual size: 79KB

.idata Size: 7KB - Virtual size: 6KB

.gfids Size: 4KB - Virtual size: 4KB

.tls Size: 1024B - Virtual size: 777B

.00cfg Size: 512B - Virtual size: 283B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 13KB - Virtual size: 12KB

.textbss
Size: - Virtual size: 714KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 367KB - Virtual size: 366KB

.data
Size: 10KB - Virtual size: 21KB

.pdata
Size: 79KB - Virtual size: 79KB

.idata
Size: 7KB - Virtual size: 6KB

.gfids
Size: 4KB - Virtual size: 4KB

.tls
Size: 1024B - Virtual size: 777B

.00cfg
Size: 512B - Virtual size: 283B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 13KB - Virtual size: 12KB