2024-02-13_139a10dc02b3510e2c4c2f4ec4b8133d_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-13_139a10dc02b3510e2c4c2f4ec4b8133d_ryuk
Size

722KB
MD5

139a10dc02b3510e2c4c2f4ec4b8133d
SHA1

02b05d67cdb4e1e1fbe09331834507344e532d5b
SHA256

041b33b25ad14b3bd9f7eeb74dece17360b498e3c302edaf113980e0b7acac69
SHA512

1834320f38d82e4d4d8b5b43c85ff2545310512af3926e4543e6a5b325486a55293721b985df74825170c20252b06c432d0c1a7d0b217bb9bd839a52244dd109
SSDEEP

12288:SQ6K5l06Dzyxapkn1WR7xm2jD2Pi0yoqnxk:p9X06Dzyxapkn1WR7xljD2PiX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-13_139a10dc02b3510e2c4c2f4ec4b8133d_ryuk

Files

2024-02-13_139a10dc02b3510e2c4c2f4ec4b8133d_ryuk
.exe windows:6 windows x64 arch:x64

36a8437b48769ef934008336b901e95d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Dennis Bush\Documents\UFTP-CC\uftpproxyd.pdb

Imports

bcrypt

BCryptEnumAlgorithms
BCryptGetProperty
BCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptFreeBuffer
BCryptGenerateSymmetricKey
BCryptEncrypt
BCryptOpenAlgorithmProvider
BCryptDecrypt
BCryptDestroyKey
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptDestroyHash
BCryptGenRandom

ncrypt

NCryptFreeBuffer
NCryptEnumKeys
NCryptOpenStorageProvider
NCryptOpenKey
NCryptCreatePersistedKey
NCryptGetProperty
NCryptSetProperty
NCryptFinalizeKey
NCryptEncrypt
NCryptDecrypt
NCryptImportKey
NCryptSignHash
NCryptVerifySignature
NCryptDeleteKey
NCryptFreeObject
NCryptSecretAgreement
NCryptDeriveKey
NCryptExportKey

ws2_32

WSACleanup
WSAStartup
gethostname
socket
ioctlsocket
closesocket
bind
freeaddrinfo
getaddrinfo
getnameinfo
WSAIoctl
WSAGetLastError
setsockopt
sendto
select
ntohs
ntohl
htons
htonl
__WSAFDIsSet

iphlpapi

GetAdaptersAddresses

kernel32

RaiseException
CreateThread
WaitForSingleObjectEx
OutputDebugStringW
OutputDebugStringA
GetProcessHeap
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
FindNextFileA
FindFirstFileExW
FindFirstFileExA
FindClose
SetEndOfFile
WriteConsoleW
SetFilePointerEx
GetTimeZoneInformation
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetStringTypeW
HeapSize
MoveFileExW
SetStdHandle
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetCurrentThread
HeapAlloc
HeapFree
GetACP
GetCommandLineW
GetCommandLineA
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
GetConsoleCP
WideCharToMultiByte
WriteFile
ReadConsoleW
GetConsoleMode
ReadFile
DuplicateHandle
DeleteFileW
GetModuleHandleW
GetSystemTimeAsFileTime
GetDiskFreeSpaceExA
GetFullPathNameA
CloseHandle
GetLastError
ReleaseMutex
WaitForSingleObject
CreateMutexA
FormatMessageA
FreeLibrary
LoadLibraryA
Sleep
GetCurrentProcess
GetCurrentProcessId
SetPriorityClass
SetConsoleCtrlHandler
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
HeapReAlloc
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcAddress
LoadLibraryExW
MultiByteToWideChar
ExitProcess
GetModuleHandleExW
CreateFileW
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime

Sections

.text
Size: 557KB - Virtual size: 557KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 74.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 1024B - Virtual size: 981B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 283B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

36a8437b48769ef934008336b901e95d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcrypt

ncrypt

ws2_32

iphlpapi

kernel32

Sections

.text Size: 557KB - Virtual size: 557KB

.rdata Size: 93KB - Virtual size: 92KB

.data Size: 25KB - Virtual size: 74.8MB

.pdata Size: 23KB - Virtual size: 22KB

.idata Size: 7KB - Virtual size: 7KB

.gfids Size: 1024B - Virtual size: 981B

.00cfg Size: 512B - Virtual size: 283B

.reloc Size: 13KB - Virtual size: 12KB

.text
Size: 557KB - Virtual size: 557KB

.rdata
Size: 93KB - Virtual size: 92KB

.data
Size: 25KB - Virtual size: 74.8MB

.pdata
Size: 23KB - Virtual size: 22KB

.idata
Size: 7KB - Virtual size: 7KB

.gfids
Size: 1024B - Virtual size: 981B

.00cfg
Size: 512B - Virtual size: 283B

.reloc
Size: 13KB - Virtual size: 12KB