2024-04-17_95c36a5a862ce5d3c219b4f8dfc7ae24_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-17_95c36a5a862ce5d3c219b4f8dfc7ae24_ryuk
Size

735KB
MD5

95c36a5a862ce5d3c219b4f8dfc7ae24
SHA1

0e1782d3a241f7575d3c0c6851591ec0e0d93756
SHA256

fe587972ed4b53dff7565055ab4744d0cda26689eaaad01cab5c07c0ca9abc70
SHA512

fe9caecd72eeddafdc3d06bb9922bde00b7a991f0c6b16c4c7f8e0ef0876dd56e71d95c575cdd3ee7fc0a239f0e7525aace6884703c6b20d89890259332779b0
SSDEEP

12288:U7SJw3+kQEVL0ZwL82r1LRQXbeE5UmenDPOoCCmq:FUQEVL0ZwL82rF6Le7nnDPO7zq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-17_95c36a5a862ce5d3c219b4f8dfc7ae24_ryuk

Files

2024-04-17_95c36a5a862ce5d3c219b4f8dfc7ae24_ryuk
.exe windows:6 windows x64 arch:x64

36a8437b48769ef934008336b901e95d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Dennis Bush\Documents\UFTP-CC\uftpproxyd.pdb

Imports

bcrypt

BCryptEnumAlgorithms
BCryptGetProperty
BCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptFreeBuffer
BCryptGenerateSymmetricKey
BCryptEncrypt
BCryptOpenAlgorithmProvider
BCryptDecrypt
BCryptDestroyKey
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptDestroyHash
BCryptGenRandom

ncrypt

NCryptFreeBuffer
NCryptEnumKeys
NCryptOpenStorageProvider
NCryptOpenKey
NCryptCreatePersistedKey
NCryptGetProperty
NCryptSetProperty
NCryptFinalizeKey
NCryptEncrypt
NCryptDecrypt
NCryptImportKey
NCryptSignHash
NCryptVerifySignature
NCryptDeleteKey
NCryptFreeObject
NCryptSecretAgreement
NCryptDeriveKey
NCryptExportKey

ws2_32

WSACleanup
WSAStartup
gethostname
socket
ioctlsocket
closesocket
bind
freeaddrinfo
getaddrinfo
getnameinfo
WSAIoctl
WSAGetLastError
setsockopt
sendto
select
ntohs
ntohl
htons
htonl
__WSAFDIsSet

iphlpapi

GetAdaptersAddresses

kernel32

RaiseException
CreateThread
WaitForSingleObjectEx
OutputDebugStringW
OutputDebugStringA
GetProcessHeap
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
FindNextFileA
FindFirstFileExW
FindFirstFileExA
FindClose
SetEndOfFile
WriteConsoleW
SetFilePointerEx
GetTimeZoneInformation
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetStringTypeW
HeapSize
MoveFileExW
SetStdHandle
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetCurrentThread
HeapAlloc
HeapFree
GetACP
GetCommandLineW
GetCommandLineA
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
GetConsoleCP
WideCharToMultiByte
WriteFile
ReadConsoleW
GetConsoleMode
ReadFile
DuplicateHandle
DeleteFileW
GetModuleHandleW
GetSystemTimeAsFileTime
GetDiskFreeSpaceExA
GetFullPathNameA
CloseHandle
GetLastError
ReleaseMutex
WaitForSingleObject
CreateMutexA
FormatMessageA
FreeLibrary
LoadLibraryA
Sleep
GetCurrentProcess
GetCurrentProcessId
SetPriorityClass
SetConsoleCtrlHandler
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
HeapReAlloc
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcAddress
LoadLibraryExW
MultiByteToWideChar
ExitProcess
GetModuleHandleExW
CreateFileW
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime

Sections

.text
Size: 570KB - Virtual size: 570KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 60.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 1024B - Virtual size: 981B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 283B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

36a8437b48769ef934008336b901e95d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcrypt

ncrypt

ws2_32

iphlpapi

kernel32

Sections

.text Size: 570KB - Virtual size: 570KB

.rdata Size: 93KB - Virtual size: 92KB

.data Size: 25KB - Virtual size: 60.2MB

.pdata Size: 23KB - Virtual size: 23KB

.idata Size: 7KB - Virtual size: 7KB

.gfids Size: 1024B - Virtual size: 981B

.00cfg Size: 512B - Virtual size: 283B

.reloc Size: 13KB - Virtual size: 12KB

.text
Size: 570KB - Virtual size: 570KB

.rdata
Size: 93KB - Virtual size: 92KB

.data
Size: 25KB - Virtual size: 60.2MB

.pdata
Size: 23KB - Virtual size: 23KB

.idata
Size: 7KB - Virtual size: 7KB

.gfids
Size: 1024B - Virtual size: 981B

.00cfg
Size: 512B - Virtual size: 283B

.reloc
Size: 13KB - Virtual size: 12KB