2024-04-10_4aebefba973647cb15e7171765f20d9d_gazer_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-10_4aebefba973647cb15e7171765f20d9d_gazer_ryuk
Size

4.7MB
MD5

4aebefba973647cb15e7171765f20d9d
SHA1

a20813a23c7c163b599a3e51a250dcfb2fce5b89
SHA256

e863ffb82f332436112a9ca0f58228baff48b0330b97ea8c6a2434ba9a12ac83
SHA512

40a87136f3aa9314409ce2756171ae98cffeb5755cbe93959b96c02234b604d1724d1f6bc401e71811568cc86e954c3213f3bcf09cb08a2d293024324a099d00
SSDEEP

98304:PkUmhAnJfCfasImv2xa9o5lGA749xo92sKnVu9gr7YWo:PkUdMfaDNhh92sKygr7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-10_4aebefba973647cb15e7171765f20d9d_gazer_ryuk

Files

2024-04-10_4aebefba973647cb15e7171765f20d9d_gazer_ryuk
.exe windows:6 windows x64 arch:x64

b50e1db402966c70a19aee1bcdba12b9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

/tmp/job12596977308133004690/build/dmengine.pdb

Imports

opengl32

glBindTexture
glBlendFunc
glClear
glClearColor
glClearDepth
glClearStencil
glColorMask
glCullFace
glDeleteTextures
glDepthFunc
glDepthMask
glDisable
glDrawArrays
glDrawBuffer
glDrawElements
glEnable
glFlush
glFrontFace
glGenTextures
glGetError
glGetFloatv
glGetIntegerv
glGetString
glPixelStorei
glPolygonOffset
glReadBuffer
glReadPixels
glScissor
glStencilFunc
glStencilMask
glStencilOp
glTexImage2D
glTexParameterf
glTexParameteri
glTexSubImage2D
glViewport
wglCreateContext
wglDeleteContext
wglGetProcAddress
wglMakeCurrent
wglShareLists

ws2_32

WSACleanup
WSAGetLastError
WSAPoll
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyaddr
gethostbyname
gethostname
getnameinfo
getpeername
getsockname
getsockopt
htonl
htons
inet_ntoa
inet_ntop
inet_pton
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket

dbghelp

MiniDumpWriteDump
StackWalk64
SymCleanup
SymFromAddr
SymFunctionTableAccess64
SymGetLineFromAddr64
SymGetModuleBase64
SymInitialize
SymSetOptions

glu32

gluErrorString

shell32

CommandLineToArgvW
SHCreateItemFromParsingName
SHGetFolderPathA
ShellExecuteA

user32

AdjustWindowRect
AdjustWindowRectEx
BringWindowToTop
CallNextHookEx
CallWindowProcA
ChangeDisplaySettingsW
CharUpperA
CharUpperW
ClientToScreen
ClipCursor
CloseClipboard
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
EmptyClipboard
EnumDisplayDevicesA
EnumDisplayMonitors
EnumDisplaySettingsA
EnumDisplaySettingsExA
EnumDisplaySettingsW
GetAsyncKeyState
GetClientRect
GetClipCursor
GetClipboardData
GetCursorPos
GetDC
GetForegroundWindow
GetKeyState
GetMessageTime
GetMonitorInfoA
GetRawInputDeviceInfoA
GetRawInputDeviceList
GetWindowLongPtrA
GetWindowPlacement
GetWindowRect
IsWindowVisible
IsZoomed
LoadCursorA
LoadCursorFromFileA
LoadCursorW
LoadIconW
LoadImageA
MapVirtualKeyW
MonitorFromWindow
OpenClipboard
PeekMessageW
PostMessageW
PostQuitMessage
RegisterClassW
RegisterDeviceNotificationA
ReleaseCapture
ReleaseDC
ScreenToClient
SendMessageA
SetCapture
SetClassLongPtrW
SetClipboardData
SetCursor
SetCursorPos
SetFocus
SetForegroundWindow
SetWindowLongPtrA
SetWindowPlacement
SetWindowPos
SetWindowTextW
SetWindowsHookExW
ShowCursor
ShowWindow
SystemParametersInfoW
TrackMouseEvent
TranslateMessage
UnhookWindowsHookEx
UnregisterClassA
UnregisterClassW
UnregisterDeviceNotification
WaitMessage

ole32

CoCreateInstance
CoInitializeEx
CoTaskMemFree
CoUninitialize

psapi

EnumProcessModules
GetModuleFileNameExA
GetModuleInformation

gdi32

CreateSolidBrush

kernel32

AcquireSRWLockExclusive
CloseHandle
CompareStringW
CreateDirectoryW
CreateFileA
CreateFileW
CreatePipe
CreateProcessW
CreateThread
DecodePointer
DeleteCriticalSection
DeleteFileW
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FormatMessageA
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetConsoleWindow
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDriveTypeW
GetEnvironmentStringsW
GetExitCodeProcess
GetFileAttributesExW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetLocaleInfoW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemTimeAsFileTime
GetTempPathW
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetVersionExA
GetVersionExW
GlobalAlloc
GlobalLock
GlobalUnlock
HeapAlloc
HeapDestroy
HeapFree
HeapQueryInformation
HeapReAlloc
HeapSize
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
InterlockedFlushSList
InterlockedPushEntrySList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
LockFileEx
MoveFileExA
MoveFileExW
MultiByteToWideChar
OutputDebugStringW
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleW
ReadFile
ReleaseSRWLockExclusive
RemoveDirectoryW
RtlCaptureContext
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlRestoreContext
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableW
SetFilePointerEx
SetFileTime
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableCS
SleepConditionVariableSRW
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
TzSpecificLocalTimeToSystemTime
UnhandledExceptionFilter
UnlockFileEx
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile

iphlpapi

GetAdaptersAddresses

xinput9_1_0

XInputGetState

dinput8

DirectInput8Create

advapi32

CryptAcquireContextW
CryptGenRandom
CryptReleaseContext

Exports

Exports

?dmHashClone32@@YAXPEAUHashState32@@PEBU1@_N@Z
?dmHashClone64@@YAXPEAUHashState64@@PEBU1@_N@Z
?dmHashFinal32@@YAIPEAUHashState32@@@Z
?dmHashFinal64@@YA_KPEAUHashState64@@@Z
?dmHashInit32@@YAXPEAUHashState32@@_N@Z
?dmHashInit64@@YAXPEAUHashState64@@_N@Z
?dmHashRelease32@@YAXPEAUHashState32@@@Z
?dmHashRelease64@@YAXPEAUHashState64@@@Z
?dmHashUpdateBuffer32@@YAXPEAUHashState32@@PEBXI@Z
?dmHashUpdateBuffer64@@YAXPEAUHashState64@@PEBXI@Z
AmdPowerXpressRequestHighPerformance
DecryptXTeaCTR
EncryptXTeaCTR
LZ4CompressBuffer
LZ4DecompressBuffer
LZ4MaxCompressedSize
NvOptimusEnablement
Particle_CreateContext
Particle_CreateInstance
Particle_DeletePrototype
Particle_DestroyContext
Particle_DestroyInstance
Particle_GenerateVertexData
Particle_GetContextMaxParticleCount
Particle_GetEmitterCount
Particle_GetInstanceStats
Particle_GetMaterial
Particle_GetMaterialPath
Particle_GetStats
Particle_GetTileSource
Particle_GetTileSourcePath
Particle_GetVertexBufferSize
Particle_Hash
Particle_IsSleeping
Particle_NewPrototype
Particle_NewPrototypeFromDDF
Particle_ReloadInstance
Particle_ReloadPrototype
Particle_RenderEmitter
Particle_ResetAttributeScratchBuffer
Particle_ResetInstance
Particle_ResetRenderConstant
Particle_SetContextMaxParticleCount
Particle_SetMaterial
Particle_SetPosition
Particle_SetRenderConstant
Particle_SetRotation
Particle_SetScale
Particle_SetScaleAlongZ
Particle_SetTileSource
Particle_StartInstance
Particle_StopInstance
Particle_Update
Particle_WriteAttributeToScratchBuffer
__swprintf_l
__vswprintf_l
_fprintf_l
_fprintf_p
_fprintf_p_l
_fprintf_s_l
_fscanf_l
_fscanf_s_l
_fwprintf_l
_fwprintf_p
_fwprintf_p_l
_fwprintf_s_l
_fwscanf_l
_fwscanf_s_l
_printf_l
_printf_p
_printf_p_l
_printf_s_l
_scanf_l
_scanf_s_l
_scprintf
_scprintf_l
_scprintf_p
_scprintf_p_l
_scwprintf
_scwprintf_l
_scwprintf_p
_scwprintf_p_l
_snprintf
_snprintf_c
_snprintf_c_l
_snprintf_l
_snprintf_s
_snprintf_s_l
_snscanf
_snscanf_l
_snscanf_s
_snscanf_s_l
_snwprintf
_snwprintf_l
_snwprintf_s
_snwprintf_s_l
_snwscanf
_snwscanf_l
_snwscanf_s
_snwscanf_s_l
_sprintf_l
_sprintf_p
_sprintf_p_l
_sprintf_s_l
_sscanf_l
_sscanf_s_l
_swprintf
_swprintf_c
_swprintf_c_l
_swprintf_l
_swprintf_p
_swprintf_p_l
_swprintf_s_l
_swscanf_l
_swscanf_s_l
_vfprintf_l
_vfprintf_p
_vfprintf_p_l
_vfprintf_s_l
_vfscanf_l
_vfscanf_s_l
_vfwprintf_l
_vfwprintf_p
_vfwprintf_p_l
_vfwprintf_s_l
_vfwscanf_l
_vfwscanf_s_l
_vprintf_l
_vprintf_p
_vprintf_p_l
_vprintf_s_l
_vscanf_l
_vscanf_s_l
_vscprintf
_vscprintf_l
_vscprintf_p
_vscprintf_p_l
_vscwprintf
_vscwprintf_l
_vscwprintf_p
_vscwprintf_p_l
_vsnprintf
_vsnprintf_c
_vsnprintf_c_l
_vsnprintf_l
_vsnprintf_s
_vsnprintf_s_l
_vsnwprintf
_vsnwprintf_l
_vsnwprintf_s
_vsnwprintf_s_l
_vsnwscanf_l
_vsnwscanf_s_l
_vsprintf_l
_vsprintf_p
_vsprintf_p_l
_vsprintf_s_l
_vsscanf_l
_vsscanf_s_l
_vswprintf
_vswprintf_c
_vswprintf_c_l
_vswprintf_l
_vswprintf_p
_vswprintf_p_l
_vswprintf_s_l
_vswscanf_l
_vswscanf_s_l
_vwprintf_l
_vwprintf_p
_vwprintf_p_l
_vwprintf_s_l
_vwscanf_l
_vwscanf_s_l
_wprintf_l
_wprintf_p
_wprintf_p_l
_wprintf_s_l
_wscanf_l
_wscanf_s_l
dmHashBuffer32
dmHashBuffer64
dmHashBufferNoReverse32
dmHashBufferNoReverse64
dmHashEnableReverseHash
dmHashReverse32
dmHashReverse64
dmHashReverseErase32
dmHashReverseErase64
dmHashReverseSafe32
dmHashReverseSafe64
dmHashString32
dmHashString64
fprintf
fprintf_s
fscanf
fscanf_s
fwprintf
fwprintf_s
fwscanf
fwscanf_s
printf
printf_s
scanf
scanf_s
snprintf
sprintf
sprintf_s
sscanf
sscanf_s
swprintf
swprintf_s
swscanf
swscanf_s
vfprintf
vfprintf_s
vfscanf
vfscanf_s
vfwprintf
vfwprintf_s
vfwscanf
vfwscanf_s
vprintf
vprintf_s
vscanf
vscanf_s
vsnprintf
vsnprintf_s
vsprintf
vsprintf_s
vsscanf
vsscanf_s
vswprintf
vswprintf_s
vswscanf
vswscanf_s
vwprintf
vwprintf_s
vwscanf
vwscanf_s
wprintf
wprintf_s
wscanf
wscanf_s

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 700KB - Virtual size: 700KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 93KB - Virtual size: 770KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 179KB - Virtual size: 179KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gxfg
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 401KB - Virtual size: 401KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b50e1db402966c70a19aee1bcdba12b9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

opengl32

ws2_32

dbghelp

glu32

shell32

user32

ole32

psapi

gdi32

kernel32

iphlpapi

xinput9_1_0

dinput8

advapi32

Exports

Exports

Sections

.text Size: 3.3MB - Virtual size: 3.3MB

.rdata Size: 700KB - Virtual size: 700KB

.data Size: 93KB - Virtual size: 770KB

.pdata Size: 179KB - Virtual size: 179KB

.00cfg Size: 512B - Virtual size: 56B

.gxfg Size: 65KB - Virtual size: 64KB

.tls Size: 512B - Virtual size: 9B

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 401KB - Virtual size: 401KB

.reloc Size: 17KB - Virtual size: 16KB

.text
Size: 3.3MB - Virtual size: 3.3MB

.rdata
Size: 700KB - Virtual size: 700KB

.data
Size: 93KB - Virtual size: 770KB

.pdata
Size: 179KB - Virtual size: 179KB

.00cfg
Size: 512B - Virtual size: 56B

.gxfg
Size: 65KB - Virtual size: 64KB

.tls
Size: 512B - Virtual size: 9B

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 401KB - Virtual size: 401KB

.reloc
Size: 17KB - Virtual size: 16KB