2024-03-26_8690d4ef29686f916c221dba4e9c98c0_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-26_8690d4ef29686f916c221dba4e9c98c0_ryuk
Size

3.6MB
MD5

8690d4ef29686f916c221dba4e9c98c0
SHA1

147cdfb88f17a9c725ec7626918d1529a5202153
SHA256

2174ecd83ce75f1dca655785ee4fab59c534ec50744df1e8b29639c7298c567b
SHA512

aa4f0157d46fa929ea2aff1a6e6ac20adc62433e7aed9039b8953514dff21e79bfe4d3d1454094b2999a4a6659726a17fedb46b763b09b92b5e22ee4db8e62b0
SSDEEP

98304:MZ5J0JlIAtijWPaZOEnrJl4BrJn0H6UFL:MZ3fL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-26_8690d4ef29686f916c221dba4e9c98c0_ryuk

Files

2024-03-26_8690d4ef29686f916c221dba4e9c98c0_ryuk
.exe windows:6 windows x64 arch:x64

26432e915d2cf6bbd5d21238cf06f65b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

WakeAllConditionVariable
LeaveCriticalSection
InitializeCriticalSection
InitializeConditionVariable
DeleteCriticalSection
EnterCriticalSection
SetConsoleTitleA
GetConsoleTitleA
LocalFree
SetThreadExecutionState
WideCharToMultiByte
GetCommandLineW
SetEndOfFile
GetStdHandle
MultiByteToWideChar
GetConsoleMode
WriteConsoleW
WaitForSingleObject
CloseHandle
CreateThread
LoadLibraryA
GetProcAddress
FreeLibrary
Sleep
SetEvent
CreateEventA
GetNumaHighestNodeNumber
SetThreadPriority
GetCurrentThread
SetThreadGroupAffinity
GetNumaNodeProcessorMaskEx
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
GetCurrentProcess
TerminateProcess
RtlPcToFileHeader
RaiseException
RtlUnwindEx
GetLastError
LoadLibraryExW
GetModuleFileNameW
DuplicateHandle
CreateProcessA
ReadFile
ExitProcess
GetModuleHandleExW
SetConsoleCtrlHandler
GetTimeZoneInformation
MoveFileExW
DeleteFileW
HeapAlloc
HeapReAlloc
HeapFree
GetModuleFileNameA
WriteFile
GetCommandLineA
GetACP
GetExitCodeProcess
GetFileAttributesExW
CreatePipe
GetFileType
GetConsoleCP
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
ReadConsoleW
FlushFileBuffers
HeapSize
GetProcessHeap
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
CreateFileW
SleepConditionVariableCS

shell32

CommandLineToArgvW

advapi32

SystemFunction036

Exports

Exports

x265_api_get_95
x265_api_query
x265_build_info_str
x265_cleanup
x265_csvlog_encode
x265_csvlog_frame
x265_csvlog_open
x265_dither_image
x265_encoder_close
x265_encoder_encode
x265_encoder_get_stats
x265_encoder_headers
x265_encoder_intra_refresh
x265_encoder_log
x265_encoder_open_95
x265_encoder_parameters
x265_encoder_reconfig
x265_max_bit_depth
x265_param_alloc
x265_param_apply_profile
x265_param_default
x265_param_default_preset
x265_param_free
x265_param_parse
x265_picture_alloc
x265_picture_free
x265_picture_init
x265_version_str

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 204KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 1024B - Virtual size: 564B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

26432e915d2cf6bbd5d21238cf06f65b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shell32

advapi32

Exports

Exports

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.rdata Size: 204KB - Virtual size: 204KB

.data Size: 9KB - Virtual size: 31KB

.pdata Size: 35KB - Virtual size: 35KB

.rodata Size: 15KB - Virtual size: 14KB

.gfids Size: 1024B - Virtual size: 564B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 3.4MB - Virtual size: 3.4MB

.rdata
Size: 204KB - Virtual size: 204KB

.data
Size: 9KB - Virtual size: 31KB

.pdata
Size: 35KB - Virtual size: 35KB

.rodata
Size: 15KB - Virtual size: 14KB

.gfids
Size: 1024B - Virtual size: 564B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 4KB