2024-01-24_8a67f3856b72720e9898f273ec9052b9_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-01-24_8a67f3856b72720e9898f273ec9052b9_ryuk
Size

311KB
MD5

8a67f3856b72720e9898f273ec9052b9
SHA1

61dd35f1f10498eb597c2439c2e85590de03a752
SHA256

8fc940c05099e2ef7105cb2b5bae816d01a68e425936c6969198530e2aed2d9a
SHA512

764fb95ead3395a854d127e1efaed0aa5e7ade2f5864dd571de5eddff4f1793a1847aabe292307859df7f7edb3da18a89b2d9e53e13a0e256a4efe0b00b57d73
SSDEEP

6144:jyIT+AlbSI4BFlwN2LmfIEpW1KDS2IEmnEv4yCPBjSdtAH+8yvLi9L:jyIT+AleIelDq3Q1qMavK4t8+8WS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-01-24_8a67f3856b72720e9898f273ec9052b9_ryuk

Files

2024-01-24_8a67f3856b72720e9898f273ec9052b9_ryuk
.exe windows:5 windows x64 arch:x64

a835c50c3d55cefed2603aacc8202c0f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ecsimulator

ord63
ord150
ord86
ord755
ord852
ord401
ord600
ord491
ord463
ord400
ord74
ord205
ord601
ord84
ord231
ord853
ord756
ord469
ord78
ord285
ord604
ord850
ord859
ord67
ord69
ord66
ord151
ord180
ord855
ord459
ord68
ord179
ord857
ord856
ord70
ord861
ord860
ord178
ord461
ord471
ord243
ord73
ord72

ecsimulatorrasserver

ord503
ord502

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces

winmm

timeBeginPeriod

kernel32

ReadFile
SetEndOfFile
HeapReAlloc
HeapSize
WriteConsoleW
SetFilePointerEx
CreateFileW
GetProcessHeap
SetStdHandle
SetConsoleCtrlHandler
SetPriorityClass
GetCurrentProcess
Sleep
SetEvent
DeviceIoControl
SetThreadPriority
WaitForSingleObject
LocalAlloc
GetLastError
CreateFileA
GetCurrentThread
CloseHandle
CreateThread
ResetEvent
LocalFree
CreateEventA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlPcToFileHeader
EncodePointer
RaiseException
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
GetStringTypeW
CompareStringW
LCMapStringW
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
ReadConsoleW

Sections

.text
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a835c50c3d55cefed2603aacc8202c0f

Headers

DLL Characteristics

File Characteristics

Imports

ecsimulator

ecsimulatorrasserver

setupapi

winmm

kernel32

Sections

.text Size: 171KB - Virtual size: 170KB

.rdata Size: 124KB - Virtual size: 124KB

.data Size: 4KB - Virtual size: 8KB

.pdata Size: 8KB - Virtual size: 7KB

.gfids Size: 512B - Virtual size: 204B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 171KB - Virtual size: 170KB

.rdata
Size: 124KB - Virtual size: 124KB

.data
Size: 4KB - Virtual size: 8KB

.pdata
Size: 8KB - Virtual size: 7KB

.gfids
Size: 512B - Virtual size: 204B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 2KB - Virtual size: 1KB