2024-02-17_dc1c6913b6eccc22fd8ca5123f18582a_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-17_dc1c6913b6eccc22fd8ca5123f18582a_ryuk
Size

1.1MB
MD5

dc1c6913b6eccc22fd8ca5123f18582a
SHA1

98623946d6eaecb9bb39864e96c0cf52d4201782
SHA256

c559e859755b08aa168a7a014ce6ef6a9a45db956717840a6cf58fc2537c1bce
SHA512

5942743dbab7188d08d4b7e31d163df3e8a0e38ca38306ea47a3528ad1dd0ed51918b8d94a588fb73b4a97cd6e8d92ebd4f63d4a303c935826d9df4371a99511
SSDEEP

12288:KYVvOGpUBKw2lQCSmUPMtetksbm3mOD347iQUsiDSscHVTbw6yov0D+6N6Zf:x7Qd2lTkvbm3BD347pUtuscHlbw6yl1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-17_dc1c6913b6eccc22fd8ca5123f18582a_ryuk

Files

2024-02-17_dc1c6913b6eccc22fd8ca5123f18582a_ryuk
.exe windows:6 windows x64 arch:x64

f75775660c55171ec80686b072faac45

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

setupapi

SetupDiGetDeviceRegistryPropertyA
SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo

kernel32

EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
CreateFileA
ReadFile
WriteFile
CloseHandle
GetLastError
GetOverlappedResult
DeviceIoControl
CancelIo
ResetEvent
WaitForSingleObject
CreateEventA
FreeLibrary
GetProcAddress
LocalFree
FormatMessageW
LoadLibraryA
QueryPerformanceCounter
QueryPerformanceFrequency
GetModuleHandleA
RaiseException
Sleep
GetCurrentThreadId
GetSystemTimeAsFileTime
TlsSetValue
CreateMutexW
ReleaseMutex
CreateEventW
SetEvent
TlsAlloc
SleepEx
TlsGetValue
TlsFree
EnterCriticalSection
GetCurrentProcess
WaitForMultipleObjects
LeaveCriticalSection
InitializeCriticalSection
DuplicateHandle
DeleteCriticalSection
VerifyVersionInfoA
ReleaseSemaphore
GetVersionExA
VerSetConditionMask
GetCurrentProcessId
CreateSemaphoreA
SetThreadAffinityMask
GetProcessAffinityMask
TerminateThread
FormatMessageA
CreateDirectoryW
CreateFileW
FindClose
GetFileAttributesW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
HeapSize
ReadConsoleW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetProcessHeap
GetTimeZoneInformation
GetConsoleMode
GetACP
GetConsoleCP
TryEnterCriticalSection
WaitForSingleObjectEx
GetCurrentThread
GetExitCodeThread
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
GetTickCount
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
RegisterWaitForSingleObject
UnregisterWait
OutputDebugStringW
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
RtlPcToFileHeader
RtlUnwindEx
GetStdHandle
GetFileType
GetModuleFileNameA
GetModuleHandleExW
WriteConsoleW
ExitThread
HeapAlloc
HeapFree
HeapReAlloc
ExitProcess
GetCommandLineA
GetCommandLineW
FlushFileBuffers

user32

UnregisterClassA
TranslateMessage
GetRawInputDeviceList
GetRawInputDeviceInfoA
GetActiveWindow
DestroyWindow
CreateWindowExA
RegisterClassExA
DispatchMessageA
DefWindowProcA
UnregisterDeviceNotification
RegisterDeviceNotificationA
PeekMessageA
GetMessageA

ole32

CoUninitialize
CoInitializeEx

Exports

Exports

hid_close
hid_enumerate
hid_error
hid_exit
hid_free_enumeration
hid_get_feature_report
hid_get_indexed_string
hid_get_manufacturer_string
hid_get_product_string
hid_get_serial_number_string
hid_init
hid_open
hid_open_path
hid_read
hid_read_timeout
hid_send_feature_report
hid_set_nonblocking
hid_write

Sections

.text
Size: 750KB - Virtual size: 749KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 267KB - Virtual size: 266KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f75775660c55171ec80686b072faac45

Headers

DLL Characteristics

File Characteristics

Imports

setupapi

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 750KB - Virtual size: 749KB

.rdata Size: 267KB - Virtual size: 266KB

.data Size: 22KB - Virtual size: 58KB

.pdata Size: 40KB - Virtual size: 40KB

.gfids Size: 4KB - Virtual size: 3KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 750KB - Virtual size: 749KB

.rdata
Size: 267KB - Virtual size: 266KB

.data
Size: 22KB - Virtual size: 58KB

.pdata
Size: 40KB - Virtual size: 40KB

.gfids
Size: 4KB - Virtual size: 3KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 7KB - Virtual size: 7KB