2024-02-03_12b67fdaced636cf5589fd9a8d754f29_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-03_12b67fdaced636cf5589fd9a8d754f29_ryuk
Size

3.2MB
MD5

12b67fdaced636cf5589fd9a8d754f29
SHA1

636c65f2d87c91322d910e4916ba8402aa918812
SHA256

15b3809b0ceeaef3e92d8481c3659dfdbcb1e07ba39e6f97f2e4b5dbd3d1bcf8
SHA512

7cba84ae6bcf8f2e89a16b6d294cdcf33c56a234b6a6147871e41ace084e5d1944a6ba72226fb898c8e7ac2e613ab22ac335eed8762e5e536bda2f8194e6032e
SSDEEP

49152:5NhTpARAu9YsfM8PAK2X0QL57v9JHPPRvx6bNjw:5TdAyurM8PAKIxvx6bNjw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-03_12b67fdaced636cf5589fd9a8d754f29_ryuk

Files

2024-02-03_12b67fdaced636cf5589fd9a8d754f29_ryuk
.exe windows:6 windows x64 arch:x64

a31e6975d0f1b97af7c8b6fc4de230fa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\opensource\openssl-1.0.1p\out32.dbg\opensslMTd.pdb

Imports

ws2_32

sendto
recvfrom
ntohl
getsockopt
ioctlsocket
WSASetLastError
send
recv
WSACancelBlockingCall
WSACleanup
WSAStartup
getservbyname
gethostbyname
gethostbyaddr
socket
setsockopt
ntohs
listen
htons
htonl
connect
bind
accept
WSAGetLastError
getsockname
shutdown
select
closesocket
__WSAFDIsSet

gdi32

CreateDCW
GetObjectW
SelectObject
GetDeviceCaps
GetBitmapBits
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
DeleteObject

advapi32

SystemFunction036
RegisterEventSourceW
ReportEventW
CryptAcquireContextA
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptEnumProvidersA
CryptSignHashA
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
DeregisterEventSource

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore

user32

MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation

kernel32

OutputDebugStringW
WaitForSingleObjectEx
GetFileAttributesExW
FlushFileBuffers
OutputDebugStringA
ReadConsoleW
SetFilePointerEx
GetCurrentDirectoryW
GetFullPathNameW
SetFileAttributesW
SetEndOfFile
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
HeapFree
HeapReAlloc
HeapQueryInformation
RaiseException
RtlPcToFileHeader
GetStringTypeW
GetConsoleCP
SetStdHandle
CloseHandle
GetLastError
Sleep
ExitProcess
CreateThread
GetStdHandle
DeleteFileW
FindClose
FindFirstFileW
ReadFile
WriteFile
GetProcessTimes
GetCurrentProcessId
OpenProcess
GetSystemTime
MoveFileW
SystemTimeToFileTime
MultiByteToWideChar
SetLastError
RtlVirtualUnwind
FlushConsoleInputBuffer
GetFileType
GetCurrentThreadId
GetModuleHandleW
GetProcAddress
QueryPerformanceCounter
GetTickCount
EncodePointer
GlobalMemoryStatus
LoadLibraryW
WideCharToMultiByte
LoadLibraryA
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
FreeLibrary
GetModuleFileNameW
RtlUnwindEx
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetModuleFileNameA
GetModuleHandleExW
WriteConsoleW
GetConsoleMode
GetNumberOfConsoleInputEvents
PeekConsoleInputA
ReadConsoleInputA
SetConsoleMode
SetConsoleCtrlHandler
GetTimeZoneInformation
CreateFileW
GetDriveTypeW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetCommandLineA
GetCommandLineW
GetACP
HeapAlloc
HeapSize
HeapValidate
GetSystemInfo
CompareStringW
LCMapStringW

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 272KB - Virtual size: 272KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 469KB - Virtual size: 493KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a31e6975d0f1b97af7c8b6fc4de230fa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

gdi32

advapi32

crypt32

user32

kernel32

Sections

.text Size: 2.4MB - Virtual size: 2.4MB

.rdata Size: 272KB - Virtual size: 272KB

.data Size: 469KB - Virtual size: 493KB

.pdata Size: 68KB - Virtual size: 67KB

.reloc Size: 22KB - Virtual size: 22KB

.text
Size: 2.4MB - Virtual size: 2.4MB

.rdata
Size: 272KB - Virtual size: 272KB

.data
Size: 469KB - Virtual size: 493KB

.pdata
Size: 68KB - Virtual size: 67KB

.reloc
Size: 22KB - Virtual size: 22KB