2024-04-10_c1c6c2df10c36dfc85d03e1d95b833f2_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2024-04-10_c1c6c2df10c36dfc85d03e1d95b833f2_ryuk
Size 195KB
Sample240410-lewvmaae69
SHA256 baa573f6d713c298d0ea60bc46061491703574460f7bad2c25f53812583bef86
MD5 c1c6c2df10c36dfc85d03e1d95b833f2
SHA1 a31e45c338b3d408c83ca83074ededf35fe0a831
SHA512 ac5f9dad5c87ca32025348e860a0ecee8a4832ebf3085840ccd3eba8c2c134b6672730b6be911b222d8473dd6262ca81e47db305568844d3496de2a687623592
SSDEEP 3072:hSf9QqTjhSp29ZPLoFrn7CdIEwCh0RP+LrzyLPwB4Sa6v9ZX0t5xT79VRSVO:hSlNQp2/LoFrnjv7POnyrwB1EtPE0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-10_c1c6c2df10c36dfc85d03e1d95b833f2_ryuk

File Explorer

2024-04-10_c1c6c2df10c36dfc85d03e1d95b833f2_ryuk

.exe 195KB

2024-04-10_c1c6c2df10c36dfc85d03e1d95b833f2_ryuk

IMPHASH d422d42843191f20ad0be6176200c3f3
SHA256 baa573f6d713c298d0ea60bc46061491703574460f7bad2c25f53812583bef86
MD5 c1c6c2df10c36dfc85d03e1d95b833f2
SHA1 a31e45c338b3d408c83ca83074ededf35fe0a831
SHA512 ac5f9dad5c87ca32025348e860a0ecee8a4832ebf3085840ccd3eba8c2c134b6672730b6be911b222d8473dd6262ca81e47db305568844d3496de2a687623592
SSDEEP 3072:hSf9QqTjhSp29ZPLoFrn7CdIEwCh0RP+LrzyLPwB4Sa6v9ZX0t5xT79VRSVO:hSlNQp2/LoFrnjv7POnyrwB1EtPE0
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

212992

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\v61A11src\v4builds\x64\Release\WSD64.pdb

newdev

UpdateDriverForPlugAndPlayDevicesW

kernel32

GetProcAddress LoadLibraryExW RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetModuleFileNameW GetModuleHandleW LoadResource SizeofResource FindResourceW MultiByteToWideChar FreeLibrary DecodePointer WaitForSingleObject Sleep CreateThread GetCurrentThreadId CreateFileW WriteConsoleW FlushFileBuffers SetFilePointerEx lstrcmpiW CreateEventW ResetEvent SetEvent GetLastError CloseHandle FindClose GetCommandLineW IsDebuggerPresent GetConsoleMode GetConsoleCP GetStringTypeW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileW LCMapStringW GetFileType HeapReAlloc HeapSize HeapAlloc HeapFree GetACP FindFirstFileExW LocalFree WriteFile OutputDebugStringW WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RtlUnwindEx EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError ExitProcess GetModuleHandleExW WideCharToMultiByte GetStdHandle

user32

CharNextW GetMessageW TranslateMessage DispatchMessageW PostThreadMessageW CharUpperW

advapi32

RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey RegSetValueExW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree CoWaitForMultipleHandles PropVariantClear CoCreateInstance CoUninitialize CoRegisterClassObject CoRevokeClassObject CoResumeClassObjects CoAddRefServerProcess CoReleaseServerProcess StringFromGUID2 CoInitialize CoGetClassObject

oleaut32

UnRegisterTypeLi RegisterTypeLi LoadRegTypeLi LoadTypeLi VarUI4FromStr SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreate SysStringLen SysAllocString SysFreeString

shlwapi

SHStrDupW

Name

.text

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.zero

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2024-04-10_c1c6c2df10c36dfc85d03e1d95b833f2_ryuk

newdev

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

generic