2024-04-18_f4f5ce45a3bfc5440520f7053be6946b_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-18_f4f5ce45a3bfc5440520f7053be6946b_ryuk
Size

1.6MB
MD5

f4f5ce45a3bfc5440520f7053be6946b
SHA1

dd95867b2c4d35abeabe33f50a7bae9b615193fe
SHA256

7976b19cf5c1744736c9d14f56d5e13740b769905583a58cf4ae697159f9b2d4
SHA512

f37c02f8c6c5ac34ce211609746ddf28893c37b0667a5f535d999d7878abd967b46817f1019beb0428b3fe6a43c29093605925f2c6d9587654e3201376bec4ca
SSDEEP

49152:j33fZW7IqFNONT02716WpAHrVQ1/fSNvi:jHfZWRN216WpAhQ1CNvi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-18_f4f5ce45a3bfc5440520f7053be6946b_ryuk

Files

2024-04-18_f4f5ce45a3bfc5440520f7053be6946b_ryuk
.exe windows:6 windows x64 arch:x64

41109199f74bd474513267bc303cf963

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

sshd.pdb

Imports

libcrypto

DH_size
ECDSA_do_sign
ECDSA_SIG_free
ECDSA_do_verify
ECDSA_SIG_new
DSA_do_sign
DSA_do_verify
DSA_SIG_new
DSA_SIG_free
RSA_public_decrypt
RSA_sign
BN_div
RSA_size
DH_compute_key
BN_CTX_new
EC_GROUP_get_degree
BN_CTX_free
RAND_status
SSLeay
EVP_CIPHER_CTX_key_length
EVP_CIPHER_CTX_new
EVP_aes_256_cbc
EVP_CIPHER_CTX_iv_length
EVP_CipherInit
EVP_des_ede3_cbc
EVP_aes_192_cbc
EVP_CIPHER_CTX_ctrl
EVP_CIPHER_CTX_set_key_length
EVP_Cipher
EVP_aes_256_gcm
EVP_aes_128_gcm
EVP_CIPHER_CTX_free
EC_POINT_oct2point
BN_bn2bin
EC_POINT_point2oct
BN_bin2bn
BN_is_bit_set
BN_hex2bn
DH_new
DH_generate_key
EVP_sha384
EC_POINT_clear_free
ECDH_compute_key
EVP_MD_CTX_copy_ex
EVP_md5
EVP_CIPHER_CTX_set_app_data
EVP_CIPHER_CTX_get_app_data
AES_set_encrypt_key
AES_encrypt
EVP_sha256
EVP_DigestUpdate
EVP_Digest
EVP_DigestInit_ex
EVP_MD_CTX_cleanup
EVP_MD_CTX_md
EVP_sha1
EVP_MD_block_size
EVP_sha512
EVP_DigestFinal_ex
RSA_blinding_on
BN_dup
EC_GROUP_get_order
DSA_free
BIO_new
EC_POINT_cmp
BN_clear_free
ERR_peek_error
EC_KEY_set_private_key
BN_value_one
EVP_PKEY_get1_EC_KEY
EC_METHOD_get_field_type
EC_POINT_mul
RSA_new
EC_KEY_generate_key
RSA_free
ERR_get_error
EC_POINT_get_affine_coordinates_GFp
ERR_peek_last_error
EC_KEY_set_public_key
BN_free
EC_KEY_set_group
EC_POINT_is_at_infinity
BIO_s_mem
PEM_read_bio_PrivateKey
EC_POINT_free
EVP_aes_128_cbc
EC_KEY_free
EVP_PKEY_free
EVP_PKEY_get1_RSA
EC_KEY_get0_public_key
EC_GROUP_free
DSA_new
EC_POINT_new
BIO_write
BIO_free
EC_GROUP_cmp
EVP_PKEY_get1_DSA
EC_GROUP_set_asn1_flag
EC_GROUP_get_curve_name
BN_new
EC_KEY_get0_private_key
EC_KEY_get0_group
BN_cmp
BN_sub
EC_GROUP_new_by_curve_name
EVP_PKEY_base_id
EC_GROUP_method_of
EC_KEY_new_by_curve_name
BN_num_bits
RAND_poll
SSLeay_version
RAND_seed
RAND_bytes
DH_free

ws2_32

shutdown
WSASend
gethostname
WSAIoctl
bind
FreeAddrInfoW
GetAddrInfoW
listen
getsockopt
WSAGetOverlappedResult
htons
getsockname
htonl
closesocket
WSADuplicateSocketW
WSASocketW
WSAGetLastError
WSARecv
getnameinfo
getpeername
socket
ntohl
inet_ntoa
inet_ntop
ntohs
getservbyname
setsockopt
WSAStartup

advapi32

EventWrite
ConvertSidToStringSidA
CreateProcessAsUserW
EventUnregister
LsaManageSidNameMapping
AdjustTokenPrivileges
AllocateLocallyUniqueId
EventRegister
EqualSid
AllocateAndInitializeSid
LookupPrivilegeValueA
CreateRestrictedToken
FreeSid
ConvertSidToStringSidW
DuplicateToken
RegQueryValueExW
GetAce
CreateWellKnownSid
CopySid
GetNamedSecurityInfoW
IsWellKnownSid
IsValidSecurityDescriptor
OpenProcessToken
GetLengthSid
IsValidAcl
LookupAccountNameW
RegOpenKeyExW
RegEnumValueW
RegCloseKey
SetServiceStatus
RegCreateKeyExW
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
ConvertStringSecurityDescriptorToSecurityDescriptorW
IsValidSid
CheckTokenMembership
LookupAccountSidW
GetSidIdentifierAuthority
GetTokenInformation
EventWriteTransfer

kernel32

GetFullPathNameW
SetFileAttributesW
RemoveDirectoryW
SetStdHandle
GetCurrentDirectoryW
SetCurrentDirectoryW
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RtlUnwindEx
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
DeleteFileW
SetEvent
VerSetConditionMask
GetCommandLineA
GetCommandLineW
FormatMessageA
CancelIoEx
CancelSynchronousIo
WriteFile
ReadFile
WaitForSingleObjectEx
WaitForMultipleObjectsEx
GetDriveTypeW
GetDiskFreeSpaceExW
GetLogicalDriveStringsW
ReadFileEx
GetFileAttributesExW
GetFileInformationByHandle
WriteFileEx
DeviceIoControl
CreateNamedPipeA
CancelIo
ReadConsoleOutputA
SetConsoleCursorPosition
GetConsoleWindow
Beep
WriteConsoleW
FillConsoleOutputAttribute
WriteConsoleOutputA
CreateFileA
PeekNamedPipe
SetConsoleCursorInfo
GetConsoleMode
SetConsoleWindowInfo
GetConsoleCP
GetConsoleCursorInfo
ScrollConsoleScreenBufferA
SetConsoleScreenBufferSize
SetConsoleTextAttribute
FillConsoleOutputCharacterA
LoadLibraryExW
MultiByteToWideChar
CreateWaitableTimerA
CancelWaitableTimer
QueueUserAPC
SetConsoleCtrlHandler
GetExitCodeProcess
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNextFileW
CreateThread
GetLastError
CloseHandle
GetComputerNameW
ExitThread
WaitForSingleObject
GetFileAttributesW
FreeLibraryAndExitThread
GetModuleFileNameW
HeapFree
CreateProcessW
CopyFileW
HeapAlloc
SetInformationJobObject
GetCurrentProcess
ExpandEnvironmentStringsW
AssignProcessToJobObject
TerminateProcess
SetEnvironmentVariableW
CreateJobObjectW
GetDateFormatW
GetEnvironmentVariableW
DuplicateHandle
OpenProcess
SetConsoleMode
CreateDirectoryW
SleepEx
GetTimeFormatW
SetWaitableTimer
GetConsoleScreenBufferInfo
CompareStringW
GetStdHandle
CreateWaitableTimerW
LCMapStringW
CreateFileW
Sleep
GetTimeZoneInformation
HeapReAlloc
LoadLibraryW
GetStringTypeW
GetProcAddress
LocalFree
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetFileType
VerifyVersionInfoW
CreateEventA
GetFinalPathNameByHandleW
ReadConsoleW
GetFileSizeEx
IsValidCodePage
GetSystemDirectoryW
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
GetCurrentProcessId
GetWindowsDirectoryW
FlushFileBuffers
FreeEnvironmentStringsW
GetProcessHeap
HeapSize
SetHandleInformation
RaiseException
GetLocalTime
SetEndOfFile
GetCurrentThreadId
ReadConsoleInputW
GetTickCount64
GetModuleHandleExW
SetFilePointerEx
GetSystemTime
OpenThread
ResetEvent

sspicli

LsaLogonUser
FreeContextBuffer
LsaRegisterLogonProcess
LsaConnectUntrusted
InitSecurityInterfaceW
LsaDeregisterLogonProcess
LsaLookupAuthenticationPackage
LsaFreeReturnBuffer

userenv

LoadUserProfileW

crypt32

CryptStringToBinaryA
CryptBinaryToStringA

user32

ShowWindow
GetWindowPlacement

Sections

.text
Size: 738KB - Virtual size: 737KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 319KB - Virtual size: 318KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 193KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

41109199f74bd474513267bc303cf963

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libcrypto

ws2_32

advapi32

kernel32

sspicli

userenv

crypt32

user32

Sections

.text Size: 738KB - Virtual size: 737KB

.rdata Size: 319KB - Virtual size: 318KB

.data Size: 7KB - Virtual size: 193KB

.pdata Size: 36KB - Virtual size: 36KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 738KB - Virtual size: 737KB

.rdata
Size: 319KB - Virtual size: 318KB

.data
Size: 7KB - Virtual size: 193KB

.pdata
Size: 36KB - Virtual size: 36KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 568KB - Virtual size: 572KB