2024-04-10_6cb1aa9819739ec6979ad4d193e62486_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-10_6cb1aa9819739ec6979ad4d193e62486_ryuk
Size

1.0MB
MD5

6cb1aa9819739ec6979ad4d193e62486
SHA1

78b597196065835703996375a89a2a9dbebaf4c5
SHA256

8b8722a289a7886f8c93b6d13c8207a951c3dde7a374be103b2efadf2e9f003f
SHA512

f79ebfc5986f8a1857210a74ccbbb34e0550b4e55ef5606977bafc57446d9840d0e2ecc1f79d23867914055586a78dbcb3d43aeb08f6f99ab58ca74588b7f599
SSDEEP

24576:PXWi1JYbuW1LPSgrtFIk6lGoqKDhxjpn6b04ilx/FtgFUrxqhrH:fWic6W1PptFIk6EoqKDhxjpn6bmbk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-10_6cb1aa9819739ec6979ad4d193e62486_ryuk

Files

2024-04-10_6cb1aa9819739ec6979ad4d193e62486_ryuk
.exe windows:6 windows x64 arch:x64

818dab387347c580babdda173b3a268b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\4n6\Documents\Visual Studio 2015\Projects\AChoir\x64\Release\AChoir.pdb

Imports

mpr

WNetUseConnectionA

winhttp

WinHttpSendRequest
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpConnect
WinHttpOpen
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpReadData

wsock32

gethostname
connect
sendto
setsockopt
WSAGetLastError
socket
send
ioctlsocket
WSAStartup
ntohl
gethostbyname
closesocket
WSACleanup
htons
recv

user32

ShowWindow

advapi32

AdjustTokenPrivileges
RegCloseKey
RegQueryValueExA
GetSidSubAuthorityCount
AllocateAndInitializeSid
LookupPrivilegeValueA
GetSidSubAuthority
RegCreateKeyExA
GetSecurityDescriptorOwner
RegSetValueExA
OpenProcessToken
FreeSid
CheckTokenMembership
RegOpenKeyExA
RegEnumValueA
SetFileSecurityA
GetSidIdentifierAuthority
GetFileSecurityA

netapi32

NetShareDel
NetShareAdd

kernel32

GetConsoleCP
GetConsoleMode
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetStringTypeW
GetExitCodeProcess
CreateProcessA
MoveFileExW
SetStdHandle
SetFilePointerEx
ReadConsoleW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
CreateDirectoryW
LoadLibraryA
GetACP
GetCommandLineW
GetCommandLineA
ReadFile
CompareFileTime
GetFileSizeEx
VerifyVersionInfoA
SetConsoleTextAttribute
GetCurrentProcess
GetStdHandle
WriteFile
GetDriveTypeA
SetFileTime
GetFullPathNameA
GetVolumeInformationA
MultiByteToWideChar
Sleep
GetTimeZoneInformation
GetLastError
CreateFileA
SetDllDirectoryA
CloseHandle
SetFileAttributesA
GetLocalTime
VerSetConditionMask
SystemTimeToFileTime
GlobalMemoryStatusEx
GetConsoleWindow
VerifyVersionInfoW
GetDiskFreeSpaceExA
DebugBreak
GetFileTime
GetComputerNameA
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
WriteConsoleW
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
RaiseException
VirtualProtect
VirtualQuery
GetModuleHandleW
LoadLibraryExA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
FindClose
FindFirstFileExW
FindNextFileW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetEnvironmentVariableA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetCurrentDirectoryW
GetDriveTypeW
GetFileType
PeekNamedPipe
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleFileNameA

Sections

.text
Size: 816KB - Virtual size: 816KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

818dab387347c580babdda173b3a268b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mpr

winhttp

wsock32

user32

advapi32

netapi32

kernel32

Sections

.text Size: 816KB - Virtual size: 816KB

.rdata Size: 160KB - Virtual size: 160KB

.data Size: 29KB - Virtual size: 105KB

.pdata Size: 38KB - Virtual size: 37KB

.gfids Size: 512B - Virtual size: 212B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 816KB - Virtual size: 816KB

.rdata
Size: 160KB - Virtual size: 160KB

.data
Size: 29KB - Virtual size: 105KB

.pdata
Size: 38KB - Virtual size: 37KB

.gfids
Size: 512B - Virtual size: 212B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB