2024-01-22_184f369ea414e160bdb4b31dad85a282_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-01-22_184f369ea414e160bdb4b31dad85a282_ryuk
Size

151KB
MD5

184f369ea414e160bdb4b31dad85a282
SHA1

37215183368a0bd3b8b7397ecd8682fbc6bceff7
SHA256

58315794d871c6edd19d4ad086e4784929f5c87206c94367422753192e6958ac
SHA512

f128afba877c3d0efe7f03c0237f904b001d9f920d145263689341171041570a967a0584ec47aa58bbb2ac4a2791837a6c3a487c7720c4c7e3c6c8af1ae49ab7
SSDEEP

3072:jfnTUzVbdI1RxXAtZQ7Ky4ZO2dExTJjCky95wkPkv:jPonI1n7kO2deJjF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-01-22_184f369ea414e160bdb4b31dad85a282_ryuk

Files

2024-01-22_184f369ea414e160bdb4b31dad85a282_ryuk
.exe windows:6 windows x64 arch:x64

bafc013b353ffe9ac6d5c4affb907d68

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-core-processthreads-l1-1-0

TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetStartupInfoW
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetCurrentProcessId
CreateThread
TerminateThread
GetCurrentThreadId
ExitProcess

api-ms-win-core-file-l1-1-0

FindClose
FindFirstFileExW
ReadFile
WriteFile
GetFileType
CreateFileW
SetFilePointerEx
FlushFileBuffers
FindNextFileW

api-ms-win-core-console-l1-1-0

WriteConsoleW
SetConsoleCtrlHandler
GetConsoleMode
GetConsoleCP

api-ms-win-core-job-l2-1-0

AssignProcessToJobObject
SetInformationJobObject
CreateJobObjectW

api-ms-win-core-handle-l1-1-0

SetHandleInformation
CloseHandle

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegQueryValueExW
RegEnumValueW
RegCloseKey

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject

api-ms-win-core-console-l2-1-0

GetLargestConsoleWindowSize
SetConsoleScreenBufferSize
AttachConsole
GetConsoleScreenBufferInfoEx
SetConsoleWindowInfo
GenerateConsoleCtrlEvent
WriteConsoleInputW
FreeConsole
ReadConsoleOutputW

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentStringsW
ExpandEnvironmentStringsW
SetStdHandle
GetCommandLineA
GetCommandLineW
GetCurrentDirectoryW
GetEnvironmentVariableW
GetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW

api-ms-win-core-namedpipe-l1-1-0

CreatePipe

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemDirectoryW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
SetLastError
RaiseException

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleW
LoadLibraryExW
FreeLibrary
GetModuleHandleExW
GetModuleFileNameW

api-ms-win-core-string-l1-1-0

CompareStringW
WideCharToMultiByte
GetStringTypeW
MultiByteToWideChar

api-ms-win-security-base-l1-1-0

RevertToSelf

user32

GetWindowThreadProcessId
PostThreadMessageW
TranslateMessage
MapVirtualKeyA
DispatchMessageW
GetMessageW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlUnwindEx
RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-localization-l1-2-0

GetACP
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringW

api-ms-win-core-heap-l1-1-0

HeapSize
GetProcessHeap
HeapFree
HeapAlloc
HeapReAlloc

Sections

.text
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bafc013b353ffe9ac6d5c4affb907d68

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-job-l2-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-console-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-security-base-l1-1-0

user32

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l1-1-0

Sections

.text Size: 92KB - Virtual size: 91KB

.rdata Size: 44KB - Virtual size: 43KB

.data Size: 6KB - Virtual size: 20KB

.pdata Size: 5KB - Virtual size: 4KB

.rsrc Size: 1024B - Virtual size: 936B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 92KB - Virtual size: 91KB

.rdata
Size: 44KB - Virtual size: 43KB

.data
Size: 6KB - Virtual size: 20KB

.pdata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 936B

.reloc
Size: 2KB - Virtual size: 1KB