2024-03-06_cc8e8a2757584d5c3146bcf9239b2cc9_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-06_cc8e8a2757584d5c3146bcf9239b2cc9_ryuk
Size

1.2MB
MD5

cc8e8a2757584d5c3146bcf9239b2cc9
SHA1

b6a7cff0fdb878ebc167b7e42ae4fd104c928e9e
SHA256

ee59b61e0251a6408f47ffe528a985c08e8154d2c56a7dc210fb649c309da415
SHA512

4385346dfdf12a6b5dbb1a8aaff75031430c0ac1a4e5fbadbd63bc0450741bd97bbe937b0ecfa280b44fa7128294fba89a70ca546f22d4673c178d73fa649998
SSDEEP

24576:Xrr5VkcGc+Zh6tD7Ok5p8e5rIWTc/FotxcHB09:71V/1+Zh6Nrp8urTcNemHB0

Score

1^/10

Malware Config

Signatures

Files

2024-03-06_cc8e8a2757584d5c3146bcf9239b2cc9_ryuk
.exe windows:6 windows x64 arch:x64

a10bfc40030753824912ebb2270b1e1a

Code Sign

31:b4:ea:72:e0:fd:7f:87:49:09:7b:07:ad:17:36:64
Certificate

Issuer

CN=EvolutionMultiply,1.2.840.113549.1.9.1=#0c1c696e626f784065766f6c7574696f6e6d756c7469706c792e6e616d65

Not Before

11/10/2018, 21:00

Not After

10/10/2019, 21:00

Subject

CN=EvolutionMultiply,1.2.840.113549.1.9.1=#0c1c696e626f784065766f6c7574696f6e6d756c7469706c792e6e616d65

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

08/03/2016, 13:10

Not After

30/05/2027, 13:10

Subject

CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegOpenKeyExA
RegCloseKey
StartServiceCtrlDispatcherA
SetServiceStatus
DuplicateTokenEx
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceObjectSecurity
GetSecurityDescriptorDacl
ConvertStringSidToSidA
LookupAccountSidA
BuildExplicitAccessWithNameA
SetEntriesInAclA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetServiceObjectSecurity
RegOpenKeyA
RegGetKeySecurity
RegSetKeySecurity
GetTokenInformation
ConvertSidToStringSidA
RegQueryValueExA
CreateProcessAsUserA
RegOpenKeyExW
RegQueryValueExW
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA

ws2_32

accept
listen
WSAStartup
WSACleanup
ioctlsocket
gethostname
htonl
ntohl
WSAGetLastError
__WSAFDIsSet
sendto
recvfrom
freeaddrinfo
getaddrinfo
WSAIoctl
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
send
recv
WSASetLastError
select

crypt32

CertFreeCertificateContext

wldap32

ord46
ord143
ord211
ord60
ord45
ord50
ord41
ord22
ord26
ord27
ord301
ord200
ord30
ord32
ord35
ord33
ord79

normaliz

IdnToAscii

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

wtsapi32

WTSQueryUserToken

rpcrt4

UuidToStringA
RpcStringFreeA

kernel32

GetTimeZoneInformation
FindClose
GetFullPathNameW
GetCurrentDirectoryW
GetFileAttributesExW
CreateProcessA
GetExitCodeProcess
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEndOfFile
SetStdHandle
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetACP
GetCommandLineW
GetCommandLineA
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
CreateFileW
FreeLibraryAndExitThread
ExitThread
SetEnvironmentVariableA
GetModuleHandleExW
ExitProcess
LoadLibraryExW
RtlUnwindEx
RtlPcToFileHeader
InitializeSListHead
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
ResetEvent
HeapDestroy
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
WideCharToMultiByte
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
ReadFile
CloseHandle
Sleep
LoadLibraryA
GetProcAddress
GetModuleHandleA
CreateThread
lstrcmpiA
GetLastError
SetEvent
CreateToolhelp32Snapshot
Process32First
Process32Next
WTSGetActiveConsoleSessionId
WaitForSingleObject
GetModuleFileNameA
GetTickCount
GetCurrentProcess
LocalFree
OpenProcess
MoveFileExA
GetBinaryTypeA
VirtualAlloc
GetThreadContext
ReadProcessMemory
VirtualAllocEx
WriteProcessMemory
TerminateProcess
InitializeCriticalSectionEx
RaiseException
DecodePointer
DeleteCriticalSection
WriteFile
FindFirstVolumeW
MultiByteToWideChar
GetVolumeInformationW
GetTickCount64
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
SleepEx
SetLastError
FormatMessageA
WaitForSingleObjectEx
VerSetConditionMask
GetSystemDirectoryA
VerifyVersionInfoA
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
ExpandEnvironmentStringsA
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetModuleHandleW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeCriticalSectionAndSpinCount
CreateEventW
WriteConsoleW

shell32

SHGetFolderPathA
SHGetSpecialFolderPathA
SHGetSpecialFolderPathW
SHGetKnownFolderPath

ole32

CoTaskMemFree
CoCreateGuid

shlwapi

SHSetValueA
PathFileExistsA
PathFindFileNameA
PathRemoveExtensionA
SHGetValueA

Sections

.text
Size: 488KB - Virtual size: 487KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tyf2il
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.up39y1
Size: 1024B - Virtual size: 580B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.ry9kcu
Size: 1024B - Virtual size: 729B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.m42lxl
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.amgbia
Size: 512B - Virtual size: 238B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.hzz0j0
Size: 512B - Virtual size: 380B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.nkkn42
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.hj07ic
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.k3s6pm
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.jy041l
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.ogmy1c
Size: 1024B - Virtual size: 708B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.xdjijd
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.o92hzb
Size: 512B - Virtual size: 460B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bw3ntk
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rj4czt
Size: 512B - Virtual size: 217B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.gh44c8
Size: 512B - Virtual size: 294B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.srudyn
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.m6q7k8
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.x2mkkq
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rv9t2l
Size: 512B - Virtual size: 127B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.cyu9n2
Size: 1024B - Virtual size: 601B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.fbdsng
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.v40o09
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.ah5hy3
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.f5dikx
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.oh43n8
Size: 512B - Virtual size: 466B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 188KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 1024B - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 464KB - Virtual size: 463KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a10bfc40030753824912ebb2270b1e1a

Code Sign

31:b4:ea:72:e0:fd:7f:87:49:09:7b:07:ad:17:36:64Certificate

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70Certificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

ws2_32

crypt32

wldap32

normaliz

userenv

wtsapi32

rpcrt4

kernel32

shell32

ole32

shlwapi

Sections

.text Size: 488KB - Virtual size: 487KB

.tyf2il Size: 2KB - Virtual size: 1KB

.up39y1 Size: 1024B - Virtual size: 580B

.ry9kcu Size: 1024B - Virtual size: 729B

.m42lxl Size: 2KB - Virtual size: 1KB

.amgbia Size: 512B - Virtual size: 238B

.hzz0j0 Size: 512B - Virtual size: 380B

.nkkn42 Size: 2KB - Virtual size: 1KB

.hj07ic Size: 2KB - Virtual size: 2KB

.k3s6pm Size: 2KB - Virtual size: 2KB

.jy041l Size: 2KB - Virtual size: 2KB

.ogmy1c Size: 1024B - Virtual size: 708B

.xdjijd Size: 2KB - Virtual size: 1KB

.o92hzb Size: 512B - Virtual size: 460B

.bw3ntk Size: 512B - Virtual size: 432B

.rj4czt Size: 512B - Virtual size: 217B

.gh44c8 Size: 512B - Virtual size: 294B

.srudyn Size: 2KB - Virtual size: 1KB

.m6q7k8 Size: 1KB - Virtual size: 1KB

.x2mkkq Size: 2KB - Virtual size: 2KB

.rv9t2l Size: 512B - Virtual size: 127B

.cyu9n2 Size: 1024B - Virtual size: 601B

.fbdsng Size: 7KB - Virtual size: 7KB

.v40o09 Size: 512B - Virtual size: 48B

.ah5hy3 Size: 2KB - Virtual size: 2KB

.f5dikx Size: 3KB - Virtual size: 2KB

.oh43n8 Size: 512B - Virtual size: 466B

.rdata Size: 188KB - Virtual size: 188KB

.data Size: 5KB - Virtual size: 12KB

.pdata Size: 23KB - Virtual size: 23KB

.gfids Size: 1024B - Virtual size: 696B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 464KB - Virtual size: 463KB

.reloc Size: 5KB - Virtual size: 4KB

31:b4:ea:72:e0:fd:7f:87:49:09:7b:07:ad:17:36:64
Certificate

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

.text
Size: 488KB - Virtual size: 487KB

.tyf2il
Size: 2KB - Virtual size: 1KB

.up39y1
Size: 1024B - Virtual size: 580B

.ry9kcu
Size: 1024B - Virtual size: 729B

.m42lxl
Size: 2KB - Virtual size: 1KB

.amgbia
Size: 512B - Virtual size: 238B

.hzz0j0
Size: 512B - Virtual size: 380B

.nkkn42
Size: 2KB - Virtual size: 1KB

.hj07ic
Size: 2KB - Virtual size: 2KB

.k3s6pm
Size: 2KB - Virtual size: 2KB

.jy041l
Size: 2KB - Virtual size: 2KB

.ogmy1c
Size: 1024B - Virtual size: 708B

.xdjijd
Size: 2KB - Virtual size: 1KB

.o92hzb
Size: 512B - Virtual size: 460B

.bw3ntk
Size: 512B - Virtual size: 432B

.rj4czt
Size: 512B - Virtual size: 217B

.gh44c8
Size: 512B - Virtual size: 294B

.srudyn
Size: 2KB - Virtual size: 1KB

.m6q7k8
Size: 1KB - Virtual size: 1KB

.x2mkkq
Size: 2KB - Virtual size: 2KB

.rv9t2l
Size: 512B - Virtual size: 127B

.cyu9n2
Size: 1024B - Virtual size: 601B

.fbdsng
Size: 7KB - Virtual size: 7KB

.v40o09
Size: 512B - Virtual size: 48B

.ah5hy3
Size: 2KB - Virtual size: 2KB

.f5dikx
Size: 3KB - Virtual size: 2KB

.oh43n8
Size: 512B - Virtual size: 466B

.rdata
Size: 188KB - Virtual size: 188KB

.data
Size: 5KB - Virtual size: 12KB

.pdata
Size: 23KB - Virtual size: 23KB

.gfids
Size: 1024B - Virtual size: 696B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 464KB - Virtual size: 463KB

.reloc
Size: 5KB - Virtual size: 4KB