/home/jskinner/.release_build/build/gn/lto_win_x64/subl.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-12_6a5ed5997cbc8482b49bced2ca8b46d3_ryuk.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-03-12_6a5ed5997cbc8482b49bced2ca8b46d3_ryuk.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-03-12_6a5ed5997cbc8482b49bced2ca8b46d3_ryuk
-
Size
3.1MB
-
MD5
6a5ed5997cbc8482b49bced2ca8b46d3
-
SHA1
483b6b13b2f5628bf1bfe711e338d3a48bb24c16
-
SHA256
7f5b202abe9fd7287c6bc894b86faa6cbaec3b56c531ef76f085bdf8ba953caf
-
SHA512
ded090e968edcf0ed5d7e022b418d2e41aaf98cacc54ea3026979aaf3b30b3a90f51813e578d10d352ef2f26a587fb6564f069c906646a6d8693f3dd599ead99
-
SSDEEP
49152:filW2ME7OqmduZV5Y5aoLKZBJ4yondfNgMNHnAKXdT1RcBtINXt2r4PRSEk1ul:f4UdSZondfNEKr+/INXt2sEE5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-03-12_6a5ed5997cbc8482b49bced2ca8b46d3_ryuk
Files
-
2024-03-12_6a5ed5997cbc8482b49bced2ca8b46d3_ryuk.exe windows:6 windows x64 arch:x64
b53854c2dd2c1fff1a36101c8edd9c90
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
gdi32
CreateCompatibleDC
CreateDIBSection
CreateFontIndirectW
DeleteDC
DeleteObject
EnumFontFamiliesExW
GetObjectW
GetTextExtentPointW
GetTextMetricsW
SelectObject
SetBkMode
SetTextColor
TextOutW
shell32
SHGetFolderPathW
user32
AllowSetForegroundWindow
GetDC
ReleaseDC
SetForegroundWindow
SystemParametersInfoW
kernel32
CancelIo
CloseHandle
CompareStringW
CreateDirectoryW
CreateEventA
CreateEventW
CreateFileA
CreateFileMappingW
CreateFileW
CreateProcessW
CreateSemaphoreW
DecodePointer
DeleteCriticalSection
DeleteFileW
DeviceIoControl
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlushFileBuffers
FormatMessageA
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleCP
GetConsoleMode
GetConsoleWindow
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetFileAttributesW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetLastError
GetLocaleInfoW
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetNamedPipeServerProcessId
GetOEMCP
GetOverlappedResult
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemTimeAsFileTime
GetThreadTimes
GetTickCount
GetUserDefaultLCID
GetVersionExW
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringW
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
LocalFree
MapViewOfFile
MoveFileExW
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleW
ReadFile
ReleaseSemaphore
RemoveDirectoryW
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetEndOfFile
SetEnvironmentVariableA
SetEnvironmentVariableW
SetEvent
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
Sleep
SwitchToThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
WaitForSingleObject
WaitForSingleObjectEx
WaitNamedPipeA
WideCharToMultiByte
WriteConsoleW
WriteFile
Sections
.text Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 585KB - Virtual size: 585KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 61KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 103KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 17B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 584KB - Virtual size: 588KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE