2024-04-17_5567c4f8d8ce977ea35e2a15b4c53613_ryuk

Sharing

Copy URL

Twitter E-mail

General

Target

2024-04-17_5567c4f8d8ce977ea35e2a15b4c53613_ryuk
Size

2.5MB
MD5

5567c4f8d8ce977ea35e2a15b4c53613
SHA1

8dcee2764e43fec1e5eef3029bd0714e5d46f919
SHA256

2e456bd9e6ea173fd1c4914f29741cb6971883aa43e6d01ccb5f68d407540686
SHA512

ee92a1026f9d358f11e9b63e63d11c6afd37f490f830e934e501e4801c6bfdc938974ab267b29fed5277f02541361fc45ef68b22d66c7e70c057d37d17d47d79
SSDEEP

24576:QokVl21w1aEcFebNs/9UfWLE36tmRCe1EGrRWy3v6QBJlGwn/UnaR25+ByesWFm6:b8lns5VUfW+zOGlWQv5/GmX++wesW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-17_5567c4f8d8ce977ea35e2a15b4c53613_ryuk

Files

2024-04-17_5567c4f8d8ce977ea35e2a15b4c53613_ryuk
.exe windows:5 windows x64 arch:x64

e586d1e03227183408ce2b7411a389dd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Lee\Desktop\sauerbraten\bin64\sauerbraten.pdb

Imports

zlib1

zError
inflate
inflateReset
inflateEnd
deflateInit2_
inflateInit2_
deflateEnd
deflate
deflateInit_
crc32
uncompress
compress2
compressBound

opengl32

glCopyTexImage2D
glCopyTexSubImage2D
glDepthRange
glHint
glTexImage1D
glDeleteTextures
glGenTextures
glTexParameteri
glTexImage2D
glTexParameteriv
glReadPixels
glGetTexLevelParameteriv
glClear
glIsEnabled
glPolygonOffset
glCullFace
glFrontFace
glClearDepth
glClearColor
glGetString
glGetIntegerv
glViewport
glScissor
glFlush
glDrawArrays
glDepthMask
glDepthFunc
glPolygonMode
glDisable
glBlendFunc
glEnable
glTexSubImage2D
glTexParameterfv
glBindTexture
glPixelStorei
glColorMask

sdl2

SDL_WasInit
SDL_ShowSimpleMessageBox
SDL_StartTextInput
SDL_StopTextInput
SDL_SetWindowFullscreen
SDL_SetWindowSize
SDL_SetWindowPosition
SDL_GetWindowFlags
SDL_SetWindowBrightness
SDL_GetError
SDL_GL_SetSwapInterval
SDL_GL_DeleteContext
SDL_DestroyWindow
SDL_GetDisplayBounds
SDL_GL_ResetAttributes
SDL_GL_SetAttribute
SDL_CreateWindow
SDL_GL_CreateContext
SDL_SetWindowMinimumSize
SDL_SetWindowMaximumSize
SDL_GetWindowSize
SDL_SetWindowGrab
SDL_SetRelativeMouseMode
SDL_ShowCursor
SDL_GetModState
SDL_free
SDL_GetClipboardText
SDL_HasClipboardText
SDL_SaveBMP_RW
SDL_FreeRW
SDL_GetColorKey
SDL_SetSurfaceBlendMode
SDL_FreeSurface
SDL_UpperBlit
SDL_CreateRGBSurface
SDL_CreateRGBSurfaceFrom
SDL_GL_GetProcAddress
SDL_DetachThread
SDL_ThreadID
SDL_GetThreadID
SDL_SetMainReady
SDL_Delay
SDL_RemoveTimer
SDL_AddTimer
SDL_WaitThread
SDL_CreateMutex
SDL_DestroyMutex
SDL_CreateThread
SDL_CreateCond
SDL_DestroyCond
SDL_CondWaitTimeout
SDL_CondBroadcast
SDL_CondWait
SDL_CondSignal
SDL_UnlockMutex
SDL_LockMutex
SDL_GetTicks
SDL_PollEvent
SDL_PumpEvents
SDL_PeepEvents
SDL_WarpMouseInWindow
SDL_GL_SwapWindow
SDL_AllocRW
SDL_RWFromFile
SDL_SetHint
SDL_Init
SDL_Quit
SDL_GetCPUCount

sdl2_image

IMG_Load
IMG_LoadTyped_RW

ws2_32

htons
WSACleanup
ntohl
htonl
WSAStartup
ntohs
__WSAFDIsSet
select
WSARecvFrom
WSASendTo
closesocket
shutdown
accept
WSAGetLastError
connect
getsockopt
ioctlsocket
setsockopt
socket
listen
getsockname
bind
gethostbyaddr
inet_ntoa
inet_addr
gethostbyname

sdl2_mixer

Mix_ResumeMusic
Mix_PausedMusic
Mix_PlayingMusic
Mix_Playing
Mix_CloseAudio
Mix_LoadWAV_RW
Mix_PlayMusic
Mix_LoadMUS
Mix_LoadMUSType_RW
Mix_AllocateChannels
Mix_FadeInChannelTimed
Mix_FreeMusic
Mix_HaltMusic
Mix_VolumeMusic
Mix_HaltChannel
Mix_SetPanning
Mix_Volume
Mix_FadingChannel
Mix_FreeChunk
Mix_SetPostMix
Mix_QuerySpec
Mix_PlayChannelTimed
Mix_FadeOutChannel
Mix_OpenAudio

winmm

timeBeginPeriod
timeGetTime
timeEndPeriod

dbghelp

StackWalk64
SymGetModuleBase64
SymFunctionTableAccess64
SymGetSymFromAddr64
SymGetLineFromAddr64
SymInitialize

kernel32

RtlPcToFileHeader
EncodePointer
RaiseException
SetEndOfFile
HeapReAlloc
HeapSize
WriteConsoleW
CreateFileW
SetStdHandle
FindFirstFileExA
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
GetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
SetLastError
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
MultiByteToWideChar
FindClose
FindNextFileA
FindFirstFileA
CreateDirectoryA
GetFileAttributesA
CloseHandle
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
GetCurrentThread
GetCurrentProcess
SetPriorityClass
GetCommandLineA
SetConsoleOutputCP
SetConsoleCP
SetConsoleScreenBufferSize
GetConsoleScreenBufferInfo
GetStdHandle
SetConsoleTitleA
GetConsoleWindow
SetConsoleCtrlHandler
AllocConsole
WriteConsoleA
ExitProcess
TerminateProcess
WideCharToMultiByte
ReadFile
WriteFile
GetModuleFileNameA
GetACP
HeapFree
HeapAlloc
GetFileType
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
DeleteFileW
MoveFileExW
GetConsoleCP
GetConsoleMode
GetStringTypeW
GetTimeZoneInformation
SetFilePointerEx
ReadConsoleW
FlushFileBuffers
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
GetCommandLineW
QueryPerformanceCounter

user32

DispatchMessageA
TranslateMessage
PeekMessageA
CreateWindowExA
RegisterClassA
AppendMenuA
CreatePopupMenu
LoadIconA
DefWindowProcA
PostQuitMessage
ShowWindow
ModifyMenuA
PostMessageA
TrackPopupMenu
GetCursorPos
SetForegroundWindow
SendMessageA
UnregisterClassA
DestroyMenu

shell32

SHGetFolderPathA
Shell_NotifyIconA

advapi32

SystemFunction036

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 366KB - Virtual size: 366KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 906KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e586d1e03227183408ce2b7411a389dd

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

zlib1

opengl32

sdl2

sdl2_image

ws2_32

sdl2_mixer

winmm

dbghelp

kernel32

user32

shell32

advapi32

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 366KB - Virtual size: 366KB

.data Size: 29KB - Virtual size: 906KB

.pdata Size: 104KB - Virtual size: 103KB

.tls Size: 512B - Virtual size: 9B

.gfids Size: 512B - Virtual size: 212B

_RDATA Size: 4KB - Virtual size: 3KB

.rsrc Size: 10KB - Virtual size: 10KB

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 366KB - Virtual size: 366KB

.data
Size: 29KB - Virtual size: 906KB

.pdata
Size: 104KB - Virtual size: 103KB

.tls
Size: 512B - Virtual size: 9B

.gfids
Size: 512B - Virtual size: 212B

_RDATA
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 10KB - Virtual size: 10KB

.reloc
Size: 9KB - Virtual size: 8KB