2024-04-21_83a8c0ec162429dc8d86591e6b8f41c6_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-21_83a8c0ec162429dc8d86591e6b8f41c6_ryuk
Size

7.1MB
MD5

83a8c0ec162429dc8d86591e6b8f41c6
SHA1

c7e7861275ac1132be55cc86ea761f054d024806
SHA256

36a303c16efd1be2c4cae11ca06bc1efa11cb774d486f26a1da38c1df9f5dabd
SHA512

c97188e2bccf792dc9a62691827f5d02cf90ac3dd5742a7d31f5363ffb1e25d65b1b69d1b30ee09dbaf21e0404ebfa5f80d9e743c0443b136e4b8c3f33de6093
SSDEEP

49152:QzLR+rsp57qkXN+OkZ25ZtinhO+QkzY42CP+Da37L138WNyG/PLA/aBDt/wzoF9U:rIpDNBmQ3mP0u+WJrwzpngYqQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-21_83a8c0ec162429dc8d86591e6b8f41c6_ryuk

Files

2024-04-21_83a8c0ec162429dc8d86591e6b8f41c6_ryuk
.exe windows:5 windows x64 arch:x64

4ec4e7f59d194159e3b8c43b8a071e1d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

shlwapi

ord219
PathFileExistsA

ws2_32

getaddrinfo
inet_pton
connect
closesocket
bind
accept
WSACleanup
gethostname
WSAGetLastError
ioctlsocket
socket
shutdown
setsockopt
sendto
send
recvfrom
recv
ntohs
listen
inet_ntoa
inet_addr
htons
getpeername
WSAStartup

dinput8

DirectInput8Create

wininet

HttpQueryInfoA
InternetCloseHandle
InternetGetConnectedState
InternetConnectA
InternetReadFile
InternetWriteFile
InternetSetOptionA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA
InternetOpenA
HttpEndRequestA
HttpSendRequestExA

xinput9_1_0

XInputGetState

opengl32

glTexSubImage2D
glTexParameteri
glTexParameterf
glTexImage2D
glScissor
glReadPixels
glReadBuffer
glPolygonOffset
glPixelStorei
glGetTexImage
glGetIntegerv
glGetError
glGenTextures
glFrontFace
glViewport
glDrawElements
glDrawBuffer
glDrawArrays
glDisable
glDepthRange
glDepthMask
glDepthFunc
glDeleteTextures
glCullFace
glClearDepth
glClearColor
glClear
glBindTexture
wglMakeCurrent
wglGetProcAddress
wglDeleteContext
wglCreateContext
glEnable

kernel32

IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleMode
GetConsoleCP
GetACP
GetUserDefaultLCID
WriteFile
HeapFree
HeapReAlloc
HeapAlloc
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
EnumSystemLocalesW
GetFileType
GetDriveTypeW
FlushFileBuffers
ReadConsoleW
GetTimeZoneInformation
GetCurrentDirectoryW
SetStdHandle
GetProcessHeap
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetCommandLineA
GetCommandLineW
FindFirstFileExW
SetEndOfFile
HeapSize
RaiseException
VirtualProtect
VirtualQuery
GetModuleHandleW
LoadLibraryExA
EncodePointer
DecodePointer
SetLastError
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
GetStdHandle
LoadLibraryA
WriteConsoleW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
OpenProcess
TerminateProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObject
Sleep
FindClose
SetFileTime
CloseHandle
GetSystemInfo
CreateEventA
GetModuleFileNameW
GetModuleHandleA
CreateProcessA
OutputDebugStringA
GetWindowsDirectoryA
SetCurrentDirectoryW
CreateDirectoryW
RemoveDirectoryW
CreateFileA
GetFileAttributesW
GetFileAttributesExA
DeleteFileW
FindFirstFileW
FindNextFileW
CopyFileA
GetVolumeInformationA
QueryPerformanceCounter
QueryPerformanceFrequency
MultiByteToWideChar
WideCharToMultiByte
GetLocaleInfoA
GetLogicalDrives
LocalFree
GetLastError
FormatMessageA
InitializeCriticalSection
WaitForMultipleObjects
ExitProcess
lstrlenA
GetTickCount
GetCurrentThreadId
CreateFileW
GetTempPathW
GetFullPathNameA
GetFullPathNameW
FreeLibraryAndExitThread
ExitThread
CreateThread
ReadFile
GetModuleHandleExW
LoadLibraryExW
InterlockedPushEntrySList
RtlPcToFileHeader
RtlUnwindEx
GetSystemTimeAsFileTime
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WaitForSingleObjectEx
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW

user32

RegisterClassExW
TranslateMessage
DispatchMessageW
PeekMessageW
DefWindowProcW
PostQuitMessage
ValidateRect
LoadIconA
LoadCursorA
ReleaseDC
RegisterClassExA
DefWindowProcA
SetWindowLongPtrA
GetWindowLongPtrA
GetWindowLongA
ClientToScreen
SetCursorPos
ShowCursor
GetClientRect
SetWindowTextW
GetDC
GetFocus
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
DestroyWindow
CreateWindowExA
LoadImageA
LoadIconW
LoadCursorW
GetDesktopWindow
ScreenToClient
MessageBoxA
AdjustWindowRectEx
GetWindowRect
UpdateWindow
GetSystemMetrics
ReleaseCapture
SetCapture
GetAsyncKeyState
SetWindowPos
ShowWindow
CreateWindowExW

gdi32

EndPage
StartPage
SetPixelFormat
SwapBuffers
EndDoc
StartDocA
StretchBlt
SelectObject
GetDeviceCaps
DeleteObject
DeleteDC
CreateCompatibleDC
ChoosePixelFormat
CreateBitmap

comdlg32

GetOpenFileNameA
CommDlgExtendedError
PrintDlgA

advapi32

RegQueryInfoKeyA
RegOpenKeyExA
RegEnumValueA
RegCloseKey
SystemFunction036

shell32

SHGetSpecialFolderPathW
ShellExecuteA
SHGetSpecialFolderPathA

ole32

CoCreateInstance
PropVariantClear
CoSetProxyBlanket
CoInitializeEx
CoUninitialize
CreateBindCtx

oleaut32

SysAllocString
SysFreeString

Sections

.text
Size: 5.0MB - Virtual size: 5.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 420KB - Virtual size: 735KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 195KB - Virtual size: 195KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4ec4e7f59d194159e3b8c43b8a071e1d

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

ws2_32

dinput8

wininet

xinput9_1_0

opengl32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 5.0MB - Virtual size: 5.0MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 420KB - Virtual size: 735KB

.pdata Size: 195KB - Virtual size: 195KB

.gfids Size: 2KB - Virtual size: 1KB

.tls Size: 512B - Virtual size: 9B

_RDATA Size: 6KB - Virtual size: 5KB

.rsrc Size: 100KB - Virtual size: 100KB

.reloc Size: 22KB - Virtual size: 22KB

.text
Size: 5.0MB - Virtual size: 5.0MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 420KB - Virtual size: 735KB

.pdata
Size: 195KB - Virtual size: 195KB

.gfids
Size: 2KB - Virtual size: 1KB

.tls
Size: 512B - Virtual size: 9B

_RDATA
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 100KB - Virtual size: 100KB

.reloc
Size: 22KB - Virtual size: 22KB