2024-01-23_5a9874b74b9d996d640a48e888090dad_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-01-23_5a9874b74b9d996d640a48e888090dad_ryuk
Size

492KB
MD5

5a9874b74b9d996d640a48e888090dad
SHA1

1f7486b06899c91a4ba12537badf3a32a3f40017
SHA256

24e0d6004fd21c98dfea3d32a0d2d0acff83e84de830c82a196bdf77d623f41d
SHA512

c77546482973149fd4097be9b2ae6b83cfce3e30a42a00306cc1495c8cf248d4cc73b121d4f919dbfbcee883e8b247f6c5be068b4f7f283eaee34db8b817f193
SSDEEP

6144:H8lIE0vcPEzLOU2pnHIYbrnQkpSkoG5Aiafofuczskoh+grVmK0M0U67O:H8lIzcfxHtQkUk3toxmRj7O

Score

1^/10

Malware Config

Signatures

Files

2024-01-23_5a9874b74b9d996d640a48e888090dad_ryuk
.exe windows:6 windows x64 arch:x64

1857152a54aa217edc376fc3b8f29348

Code Sign

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

Issuer

CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM

Not Before

30/05/2014, 16:35

Not After

17/03/2021, 18:33

Subject

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

56:00:00:0c:3b:f9:a3:68:22:89:a0:6f:40:00:00:00:00:0c:3b
Certificate

Issuer

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Not Before

03/02/2020, 10:53

Not After

17/06/2021, 23:59

Subject

CN=Intel(R) pGFX 2020,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

18:46:93:cb:3c:71:be:64:ab:fc:39:d9:5a:f0:e0:d8:31:9e:e8:bf
Certificate

Issuer

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Not Before

07/09/2018, 20:18

Not After

17/03/2021, 18:33

Subject

CN=timestamp.intel.com,OU=Thales TSS ESN:6C37-9665-74EC,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:18:54:86:00:00:00:00:00:24
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2011, 22:06

Not After

11/04/2021, 22:16

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/10/2015, 00:00

Not After

17/06/2021, 23:59

Subject

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:98:13:94:6f:a0:74:32:60:ca:00:00:00:00:00:98
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/03/2020, 17:48

Not After

05/03/2021, 17:48

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c7:5b:0f:cb:71:ce:94:15:0c:22:1c:b6:29:cf:ab:ce:2b:23:b1:66:5e:95:76:49:0f:35:65:19:96:e8:79:a4
Signer

Actual PE Digest

c7:5b:0f:cb:71:ce:94:15:0c:22:1c:b6:29:cf:ab:ce:2b:23:b1:66:5e:95:76:49:0f:35:65:19:96:e8:79:a4

Digest Algorithm

sha256

PE Digest Matches

true

c7:5b:0f:cb:71:ce:94:15:0c:22:1c:b6:29:cf:ab:ce:2b:23:b1:66:5e:95:76:49:0f:35:65:19:96:e8:79:a4
Signer

Actual PE Digest

c7:5b:0f:cb:71:ce:94:15:0c:22:1c:b6:29:cf:ab:ce:2b:23:b1:66:5e:95:76:49:0f:35:65:19:96:e8:79:a4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW
GetStdHandle
ExpandEnvironmentStringsW
SetStdHandle
GetCommandLineA
FreeEnvironmentStringsW
GetEnvironmentStringsW

api-ms-win-core-file-l1-1-0

GetFileType
FlushFileBuffers
SetFilePointerEx
WriteFile
CreateDirectoryW
SetEndOfFile
ReadFile
FindClose
FindFirstFileExW
FindNextFileW
CreateFileW

api-ms-win-core-errorhandling-l1-1-0

SetLastError
RaiseException
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx
WaitForSingleObjectEx
TryEnterCriticalSection
DeleteCriticalSection
ResetEvent
LeaveCriticalSection
CreateEventW
WaitForMultipleObjectsEx
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
InitializeCriticalSection
SetEvent

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
CreateThread
ResumeThread
TlsGetValue
ExitProcess
GetCurrentProcess
OpenProcessToken
GetCurrentProcessId
GetStartupInfoW
TlsSetValue
TlsFree
TlsAlloc

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-libraryloader-l1-2-0

LoadStringW
GetModuleHandleExW
LoadResource
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
SizeofResource

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-string-l2-1-0

CharNextW
CharUpperW

api-ms-win-core-string-l1-1-0

GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegEnumKeyExW
RegSetValueExW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-core-com-l1-1-0

CoRegisterClassObject
CoInitializeEx
CoRevokeClassObject
CoCreateInstance
CoResumeClassObjects
CoAddRefServerProcess
CoTaskMemFree
CoReleaseServerProcess
CoUninitialize
CoTaskMemRealloc
CoTaskMemAlloc
CoInitializeSecurity

oleaut32

SafeArrayGetLBound
SafeArrayDestroy
SafeArrayRedim
SafeArrayGetUBound
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
SysFreeString
SafeArrayLock
SafeArrayUnlock
SafeArrayCopy
SafeArrayGetVartype
VariantInit
VariantClear
SafeArrayCreate

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetSystemTimeAsFileTime

api-ms-win-devices-config-l1-1-1

CM_Get_Device_Interface_List_SizeW
CM_Register_Notification
CM_Get_Device_Interface_ListW
CM_Unregister_Notification

api-ms-win-core-io-l1-1-0

DeviceIoControl
GetOverlappedResult

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-heap-l1-1-0

HeapReAlloc
GetProcessHeap
HeapFree
HeapSize
HeapAlloc

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges
MakeAbsoluteSD

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-service-management-l2-1-0

ChangeServiceConfigW
QueryServiceConfigW

api-ms-win-service-management-l1-1-0

OpenSCManagerW
OpenServiceW
CloseServiceHandle
CreateServiceW
DeleteService

api-ms-win-service-winsvc-l1-1-0

ControlService

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

user32

DispatchMessageW
TranslateMessage
GetMessageW
PostThreadMessageW

api-ms-win-core-localization-l1-2-0

GetCPInfo
GetLocaleInfoW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetACP
IsValidCodePage
GetOEMCP

api-ms-win-core-rtlsupport-l1-1-0

RtlPcToFileHeader
RtlUnwindEx
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-console-l1-1-0

WriteConsoleW
GetConsoleMode
GetConsoleCP
ReadConsoleW

Exports

Exports

MessageBoxW

Sections

.text
Size: 295KB - Virtual size: 294KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 146KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1857152a54aa217edc376fc3b8f29348

Code Sign

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bfCertificate

Key Usages

56:00:00:0c:3b:f9:a3:68:22:89:a0:6f:40:00:00:00:00:0c:3bCertificate

Extended Key Usages

Key Usages

18:46:93:cb:3c:71:be:64:ab:fc:39:d9:5a:f0:e0:d8:31:9e:e8:bfCertificate

Extended Key Usages

Key Usages

61:18:54:86:00:00:00:00:00:24Certificate

Key Usages

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3Certificate

Extended Key Usages

Key Usages

33:00:00:00:98:13:94:6f:a0:74:32:60:ca:00:00:00:00:00:98Certificate

Extended Key Usages

61:0b:aa:c1:00:00:00:00:00:09Certificate

Key Usages

c7:5b:0f:cb:71:ce:94:15:0c:22:1c:b6:29:cf:ab:ce:2b:23:b1:66:5e:95:76:49:0f:35:65:19:96:e8:79:a4Signer

c7:5b:0f:cb:71:ce:94:15:0c:22:1c:b6:29:cf:ab:ce:2b:23:b1:66:5e:95:76:49:0f:35:65:19:96:e8:79:a4Signer

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-com-l1-1-0

oleaut32

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-io-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-security-sddl-l1-1-0

user32

api-ms-win-core-localization-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-console-l1-1-0

Exports

Exports

Sections

.text Size: 295KB - Virtual size: 294KB

.rdata Size: 146KB - Virtual size: 146KB

.data Size: 8KB - Virtual size: 15KB

.pdata Size: 16KB - Virtual size: 15KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 3KB

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

56:00:00:0c:3b:f9:a3:68:22:89:a0:6f:40:00:00:00:00:0c:3b
Certificate

18:46:93:cb:3c:71:be:64:ab:fc:39:d9:5a:f0:e0:d8:31:9e:e8:bf
Certificate

61:18:54:86:00:00:00:00:00:24
Certificate

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3
Certificate

33:00:00:00:98:13:94:6f:a0:74:32:60:ca:00:00:00:00:00:98
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

c7:5b:0f:cb:71:ce:94:15:0c:22:1c:b6:29:cf:ab:ce:2b:23:b1:66:5e:95:76:49:0f:35:65:19:96:e8:79:a4
Signer

c7:5b:0f:cb:71:ce:94:15:0c:22:1c:b6:29:cf:ab:ce:2b:23:b1:66:5e:95:76:49:0f:35:65:19:96:e8:79:a4
Signer

.text
Size: 295KB - Virtual size: 294KB

.rdata
Size: 146KB - Virtual size: 146KB

.data
Size: 8KB - Virtual size: 15KB

.pdata
Size: 16KB - Virtual size: 15KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 3KB