2024-04-10_744ad0ebaf24b37e017bcdfc037f9247_gazer_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2024-04-10_744ad0ebaf24b37e017bcdfc037f9247_gazer_ryuk
Size 5.4MB
Sample240410-bndqasbd74
SHA256 c7db25aefdcf112c1cc69fc2be6e59fbcefa39c9a0ce947d272649d23e957d40
MD5 744ad0ebaf24b37e017bcdfc037f9247
SHA1 3905c4ae03d5a491ce2d58cb337650009aeb741a
SHA512 5ccf2b274f3861c524c1db38e91c1639c1a96358dac1d795628d57d016c4aa0e592fa8ab50e3b672880c5bce7b303e9e49df382838f14e14bbc1642957dfeae4
SSDEEP 98304:MkHHuLqZe51aUhgyGEQCzfMQ8oTtc4rnQ+aA/OWhlA9GRDF:VHnZe51/zGEvV0+aA/JlJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-10_744ad0ebaf24b37e017bcdfc037f9247_gazer_ryuk

File Explorer

2024-04-10_744ad0ebaf24b37e017bcdfc037f9247_gazer_ryuk

.exe 5.4MB

2024-04-10_744ad0ebaf24b37e017bcdfc037f9247_gazer_ryuk

IMPHASH b5bcdb628ce5b74118b2deb4358c7d13
SHA256 c7db25aefdcf112c1cc69fc2be6e59fbcefa39c9a0ce947d272649d23e957d40
MD5 744ad0ebaf24b37e017bcdfc037f9247
SHA1 3905c4ae03d5a491ce2d58cb337650009aeb741a
SHA512 5ccf2b274f3861c524c1db38e91c1639c1a96358dac1d795628d57d016c4aa0e592fa8ab50e3b672880c5bce7b303e9e49df382838f14e14bbc1642957dfeae4
SSDEEP 98304:MkHHuLqZe51aUhgyGEQCzfMQ8oTtc4rnQ+aA/OWhlA9GRDF:VHnZe51/zGEvV0+aA/JlJ
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3474132

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

/tmp/job11962467537587502553/build/dmengine.pdb

openal32

alBufferData alDeleteBuffers alDeleteSources alGenBuffers alGenSources alGetError alGetSourcei alGetString alSourcePlay alSourceQueueBuffers alSourceStop alSourceUnqueueBuffers alcCloseDevice alcCreateContext alcDestroyContext alcGetCurrentContext alcMakeContextCurrent alcOpenDevice alcProcessContext

opengl32

glBindTexture glBlendFunc glClear glClearColor glClearDepth glClearStencil glColorMask glCullFace glDeleteTextures glDepthFunc glDepthMask glDisable glDrawArrays glDrawBuffer glDrawElements glEnable glFlush glFrontFace glGenTextures glGetError glGetFloatv glGetIntegerv glGetString glPixelStorei glPolygonOffset glReadBuffer glReadPixels glScissor glStencilFunc glStencilMask glStencilOp glTexImage2D glTexParameterf glTexParameteri glTexSubImage2D glViewport wglCreateContext wglDeleteContext wglGetProcAddress wglMakeCurrent wglShareLists

ws2_32

WSACleanup WSAGetLastError WSAPoll WSAStartup __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyaddr gethostbyname gethostname getnameinfo getpeername getsockname getsockopt htonl htons inet_ntoa inet_ntop inet_pton ioctlsocket listen ntohl ntohs recv recvfrom select send sendto setsockopt shutdown socket

dbghelp

MiniDumpWriteDump StackWalk64 SymCleanup SymFromAddr SymFunctionTableAccess64 SymGetLineFromAddr64 SymGetModuleBase64 SymInitialize SymSetOptions

glu32

gluErrorString

shell32

SHGetFolderPathA ShellExecuteA

psapi

EnumProcessModules GetModuleFileNameExA GetModuleInformation

gdi32

CreateSolidBrush

user32

AdjustWindowRectEx BringWindowToTop CallNextHookEx ChangeDisplaySettingsW CharUpperA CharUpperW ClientToScreen ClipCursor CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EnumDisplaySettingsW GetAsyncKeyState GetClientRect GetCursorPos GetDC GetForegroundWindow GetKeyState GetMessageTime GetRawInputDeviceInfoA GetRawInputDeviceList GetWindowRect LoadCursorW LoadIconW MapVirtualKeyW PeekMessageW PostMessageW PostQuitMessage RegisterClassW RegisterDeviceNotificationA ReleaseCapture ReleaseDC ScreenToClient SetCapture SetClassLongPtrW SetCursorPos SetFocus SetForegroundWindow SetWindowPos SetWindowTextW SetWindowsHookExW ShowCursor ShowWindow SystemParametersInfoW TranslateMessage UnhookWindowsHookEx UnregisterClassW UnregisterDeviceNotification WaitMessage

iphlpapi

GetAdaptersAddresses

xinput9_1_0

XInputGetState

dinput8

DirectInput8Create

advapi32

CryptAcquireContextW CryptGenRandom CryptReleaseContext

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateDirectoryW CreateFileA CreateFileW CreatePipe CreateProcessW CreateThread DeleteCriticalSection DeleteFileW DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetExitCodeProcess GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocaleInfoW GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetTempPathW GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVersionExA GetVersionExW HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead InterlockedFlushSList InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalAlloc LocalFree MoveFileExA MoveFileExW MultiByteToWideChar OutputDebugStringW PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RemoveDirectoryW RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlRestoreContext RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableCS SleepConditionVariableSRW SystemTimeToTzSpecificLocalTime TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

?dmHashClone32@@YAXPEAUHashState32@@PEBU1@_N@Z ?dmHashClone64@@YAXPEAUHashState64@@PEBU1@_N@Z ?dmHashFinal32@@YAIPEAUHashState32@@@Z ?dmHashFinal64@@YA_KPEAUHashState64@@@Z ?dmHashInit32@@YAXPEAUHashState32@@_N@Z ?dmHashInit64@@YAXPEAUHashState64@@_N@Z ?dmHashRelease32@@YAXPEAUHashState32@@@Z ?dmHashRelease64@@YAXPEAUHashState64@@@Z ?dmHashUpdateBuffer32@@YAXPEAUHashState32@@PEBXI@Z ?dmHashUpdateBuffer64@@YAXPEAUHashState64@@PEBXI@Z AmdPowerXpressRequestHighPerformance DecryptXTeaCTR EncryptXTeaCTR LZ4CompressBuffer LZ4DecompressBuffer LZ4MaxCompressedSize NvOptimusEnablement Particle_CreateContext Particle_CreateInstance Particle_DeletePrototype Particle_DestroyContext Particle_DestroyInstance Particle_GenerateVertexData Particle_GetContextMaxParticleCount Particle_GetEmitterCount Particle_GetInstanceStats Particle_GetMaterial Particle_GetMaterialPath Particle_GetStats Particle_GetTileSource Particle_GetTileSourcePath Particle_GetVertexBufferSize Particle_Hash Particle_IsSleeping Particle_NewPrototype Particle_NewPrototypeFromDDF Particle_ReloadInstance Particle_ReloadPrototype Particle_RenderEmitter Particle_ResetAttributeScratchBuffer Particle_ResetInstance Particle_ResetRenderConstant Particle_SetContextMaxParticleCount Particle_SetMaterial Particle_SetPosition Particle_SetRenderConstant Particle_SetRotation Particle_SetScale Particle_SetScaleAlongZ Particle_SetTileSource Particle_StartInstance Particle_StopInstance Particle_Update Particle_WriteAttributeToScratchBuffer __swprintf_l __vswprintf_l _fprintf_l _fprintf_p _fprintf_p_l _fprintf_s_l _fscanf_l _fscanf_s_l _fwprintf_l _fwprintf_p _fwprintf_p_l _fwprintf_s_l _fwscanf_l _fwscanf_s_l _printf_l _printf_p _printf_p_l _printf_s_l _scanf_l _scanf_s_l _scprintf _scprintf_l _scprintf_p _scprintf_p_l _scwprintf _scwprintf_l _scwprintf_p _scwprintf_p_l _snprintf _snprintf_c _snprintf_c_l _snprintf_l _snprintf_s _snprintf_s_l _snscanf _snscanf_l _snscanf_s _snscanf_s_l _snwprintf _snwprintf_l _snwprintf_s _snwprintf_s_l _snwscanf _snwscanf_l _snwscanf_s _snwscanf_s_l _sprintf_l _sprintf_p _sprintf_p_l _sprintf_s_l _sscanf_l _sscanf_s_l _swprintf _swprintf_c _swprintf_c_l _swprintf_l _swprintf_p _swprintf_p_l _swprintf_s_l _swscanf_l _swscanf_s_l _vfprintf_l _vfprintf_p _vfprintf_p_l _vfprintf_s_l _vfscanf_l _vfscanf_s_l _vfwprintf_l _vfwprintf_p _vfwprintf_p_l _vfwprintf_s_l _vfwscanf_l _vfwscanf_s_l _vprintf_l _vprintf_p _vprintf_p_l _vprintf_s_l _vscanf_l _vscanf_s_l _vscprintf _vscprintf_l _vscprintf_p _vscprintf_p_l _vscwprintf _vscwprintf_l _vscwprintf_p _vscwprintf_p_l _vsnprintf _vsnprintf_c _vsnprintf_c_l _vsnprintf_l _vsnprintf_s _vsnprintf_s_l _vsnwprintf _vsnwprintf_l _vsnwprintf_s _vsnwprintf_s_l _vsnwscanf_l _vsnwscanf_s_l _vsprintf_l _vsprintf_p _vsprintf_p_l _vsprintf_s_l _vsscanf_l _vsscanf_s_l _vswprintf _vswprintf_c _vswprintf_c_l _vswprintf_l _vswprintf_p _vswprintf_p_l _vswprintf_s_l _vswscanf_l _vswscanf_s_l _vwprintf_l _vwprintf_p _vwprintf_p_l _vwprintf_s_l _vwscanf_l _vwscanf_s_l _wprintf_l _wprintf_p _wprintf_p_l _wprintf_s_l _wscanf_l _wscanf_s_l dmHashBuffer32 dmHashBuffer64 dmHashBufferNoReverse32 dmHashBufferNoReverse64 dmHashEnableReverseHash dmHashReverse32 dmHashReverse64 dmHashReverseErase32 dmHashReverseErase64 dmHashReverseSafe32 dmHashReverseSafe64 dmHashString32 dmHashString64 fprintf fprintf_s fscanf fscanf_s fwprintf fwprintf_s fwscanf fwscanf_s printf printf_s scanf scanf_s snprintf sprintf sprintf_s sscanf sscanf_s swprintf swprintf_s swscanf swscanf_s vfprintf vfprintf_s vfscanf vfscanf_s vfwprintf vfwprintf_s vfwscanf vfwscanf_s vprintf vprintf_s vscanf vscanf_s vsnprintf vsnprintf_s vsprintf vsprintf_s vsscanf vsscanf_s vswprintf vswprintf_s vswscanf vswscanf_s vwprintf vwprintf_s vwscanf vwscanf_s wprintf wprintf_s wscanf wscanf_s

Name

.text

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

755KB

Virtual Size

755KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

105KB

Virtual Size

787KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

209KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

401KB

Virtual Size

401KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2024-04-10_744ad0ebaf24b37e017bcdfc037f9247_gazer_ryuk

openal32

opengl32

ws2_32

dbghelp

glu32

shell32

psapi

gdi32

user32

iphlpapi

xinput9_1_0

dinput8

advapi32

kernel32

generic