2024-01-23_0a426228cfeeaf4b33c9d860f04c6b8b_ryuk

Sharing

Copy URL

Twitter E-mail

General

Target

2024-01-23_0a426228cfeeaf4b33c9d860f04c6b8b_ryuk
Size

5.1MB
MD5

0a426228cfeeaf4b33c9d860f04c6b8b
SHA1

a36b2cdcce1b4e014060d00dcbd7a8713b39700b
SHA256

290a1e82a5519c8074796759a54fe538ccf3bdd496f4dfb8459f7683d604c032
SHA512

409af7a06ab591612dfcc0a4672d9a65d35cc9e639f673e4c24a3abc85e8827d3c1f723e37b2a3ab9cb9f34f81b200209e2372d8ca93ff4d51f309c7e5303be7
SSDEEP

49152:cLtuC1gbzbSzVLF6FIbNcIyuedFOATgnCkE6MpgR0HtunO+1vK6TOO0hw09:Ogr28Vi1Kpw0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-01-23_0a426228cfeeaf4b33c9d860f04c6b8b_ryuk

Files

2024-01-23_0a426228cfeeaf4b33c9d860f04c6b8b_ryuk
.exe windows:6 windows x64 arch:x64

8573d21d4cf2b98968fe6984f466125c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

comctl32

ImageList_LoadImageW
InitCommonControlsEx
ImageList_Destroy

uxtheme

SetWindowTheme
SetThemeAppProperties

kernel32

SetCurrentDirectoryW
GetLongPathNameW
GlobalLock
GlobalUnlock
CreateDirectoryW
GetModuleFileNameW
GetFileAttributesExW
GetSystemInfo
OpenEventA
RtlCaptureStackBackTrace
CreateSemaphoreA
CreateFileMappingA
LocalAlloc
UnmapViewOfFile
MapViewOfFile
SetFilePointer
GetFileSize
CreateFileA
HeapSize
WriteConsoleW
SetStdHandle
OutputDebugStringA
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
FindNextFileA
FindFirstFileExW
FindFirstFileExA
GetProcessHeap
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
SetConsoleCtrlHandler
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetTimeZoneInformation
GetFileType
GetACP
CreateWaitableTimerA
VerifyVersionInfoW
GetModuleFileNameA
GetModuleHandleExW
ResumeThread
ExitThread
HeapFree
HeapReAlloc
HeapAlloc
ReadFile
RtlUnwindEx
RaiseException
RtlPcToFileHeader
WaitForSingleObject
LoadLibraryW
WaitForMultipleObjectsEx
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
SetProcessAffinityMask
VirtualProtect
VirtualFree
VirtualAlloc
GetVersionExW
LoadLibraryExW
FreeLibraryAndExitThread
FreeLibrary
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
GetCurrencyFormatW
GetTimeFormatW
GetDateFormatW
VerSetConditionMask
GetModuleHandleW
CreateProcessW
CloseHandle
ReleaseMutex
CreateMutexW
DeleteCriticalSection
InitializeCriticalSection
GetLastError
LeaveCriticalSection
EnterCriticalSection
GetStdHandle
SetWaitableTimer
SystemTimeToFileTime
WriteFile
FoldStringW
EnumSystemLocalesA
IsDBCSLeadByteEx
IsValidCodePage
GetLocaleInfoA
FormatMessageA
LocalFree
AreFileApisANSI
MoveFileExW
CopyFileW
CreateDirectoryExW
GetModuleHandleA
GetWindowsDirectoryW
DeviceIoControl
SetFileTime
SetFilePointerEx
SetFileAttributesW
SetEndOfFile
ExitProcess
SetEvent
CreateEventA
GetUserDefaultUILanguage
GlobalMemoryStatusEx
OutputDebugStringW
GetQueuedCompletionStatus
CreateFileW
ReadDirectoryChangesW
CreateIoCompletionPort
FormatMessageW
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
TryEnterCriticalSection
GetCurrentThreadId
DuplicateHandle
WaitForSingleObjectEx
Sleep
GetCurrentProcess
GetCurrentThread
GetExitCodeThread
GetNativeSystemInfo
QueryPerformanceCounter
QueryPerformanceFrequency
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
ResetEvent
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
GetEnvironmentVariableW
GetCurrentDirectoryW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileInformationByHandle
GetFileTime
GetFullPathNameW
RemoveDirectoryW

user32

EnableWindow
IsDlgButtonChecked
ReleaseDC
SendDlgItemMessageW
GetKeyState
CallWindowProcW
SetWindowLongPtrW
SendMessageW
GetClipboardData
IsClipboardFormatAvailable
IsWindowVisible
CreateDialogParamW
SetDlgItemTextW
BringWindowToTop
CheckDlgButton
DialogBoxParamW
CreatePopupMenu
CheckMenuItem
GetMessageW
SetWindowPos
CreateWindowExW
DispatchMessageW
IsDialogMessageW
TranslateMessage
SetCursor
RegisterWindowMessageW
GetWindowTextLengthW
DefWindowProcW
LoadMenuW
RemovePropW
SetWindowTextW
TrackPopupMenu
GetSubMenu
RedrawWindow
ClientToScreen
MoveWindow
GetDlgItem
GetClientRect
PostQuitMessage
ShowCursor
GetWindowTextW
SetTimer
KillTimer
EnumDisplayMonitors
GetMonitorInfoW
ValidateRect
GetForegroundWindow
SetCapture
ReleaseCapture
SetCursorPos
GetCursorPos
PostMessageW
MessageBoxW
GetSystemMetrics
UnregisterClassW
GetWindowLongPtrW
GetWindowPlacement
ShowWindow
OpenClipboard
CloseClipboard
EmptyClipboard
LoadIconW
FindWindowW
SetClipboardData
IsZoomed
SetForegroundWindow
IsIconic
EndDialog
FillRect
GetPropW
RegisterClassExW
EnumPropsW
SetPropW
LoadCursorW
GetSysColorBrush
GetParent
InvalidateRect
BeginPaint
EndPaint
GetWindowRect
DestroyWindow
ScreenToClient
GetFocus
DestroyMenu
InsertMenuItemW
GetDC
MessageBoxA

gdi32

CreateCompatibleBitmap
SetDIBitsToDevice
CreateSolidBrush
SetPixel
CreateDIBitmap
BitBlt
SelectObject
CreateCompatibleDC
DeleteDC
CreateFontW
DeleteObject
GetTextExtentPoint32W

comdlg32

GetOpenFileNameW

shell32

SHFileOperationW
SHGetFolderPathW
DragFinish
SHFreeNameMappings
DragQueryFileW
Shell_NotifyIconW

ole32

CoCreateInstance
CoInitializeEx

d3d9

Direct3DCreate9Ex

ws2_32

htons
htonl
ntohs
ntohl

shlwapi

PathIsDirectoryW
StrCmpLogicalW

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 85KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 223KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8573d21d4cf2b98968fe6984f466125c

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

uxtheme

kernel32

user32

gdi32

comdlg32

shell32

ole32

d3d9

ws2_32

shlwapi

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 85KB - Virtual size: 113KB

.pdata Size: 223KB - Virtual size: 223KB

.gfids Size: 6KB - Virtual size: 5KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 106KB - Virtual size: 106KB

.reloc Size: 17KB - Virtual size: 16KB

.text
Size: 3.4MB - Virtual size: 3.4MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 85KB - Virtual size: 113KB

.pdata
Size: 223KB - Virtual size: 223KB

.gfids
Size: 6KB - Virtual size: 5KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 106KB - Virtual size: 106KB

.reloc
Size: 17KB - Virtual size: 16KB