2024-04-26_0e33b23d5651e90dcce204ee86248217_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-26_0e33b23d5651e90dcce204ee86248217_ryuk
Size

16.1MB
MD5

0e33b23d5651e90dcce204ee86248217
SHA1

1f1dd806db1c04f2586fcc86378917014b32cac5
SHA256

6411e459df15c19e811edb31b4d821a36346b6642ff53797c6df9e9ff522d195
SHA512

712b2356f523d321c03d8d3bb78a8009400b7ff88b0785a0fcffd24968f77f02319cd23de1d190f5d5ec721e6f5a4a6bba89be9f2cda0671c0814c4801dc604f
SSDEEP

393216:haPGo0WDQKliDW3CxiTYKf3FjoOxb4PWU3FGkSKYYRf6aJEvoar9c1we20Ks+IBQ:M3sKR

Score

1^/10

Malware Config

Signatures

Files

2024-04-26_0e33b23d5651e90dcce204ee86248217_ryuk
.exe windows:5 windows x64 arch:x64

213ff597f2d2bedc0644ac02143949f2

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:13:89:4d:ab:d7:6f:65:dc:b4:d0:e7:9f:01:a8:08
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

10/10/2023, 00:00

Not After

09/10/2024, 23:59

Subject

CN=Qualys\, Inc,O=Qualys\, Inc,L=Foster City,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

73:7c:53:a5:bd:b5:0a:b6:f1:b2:82:61:13:42:e6:94:a9:0b:32:53:cf:5c:07:ec:50:7d:e4:4c:7e:f0:e9:ab
Signer

Actual PE Digest

73:7c:53:a5:bd:b5:0a:b6:f1:b2:82:61:13:42:e6:94:a9:0b:32:53:cf:5c:07:ec:50:7d:e4:4c:7e:f0:e9:ab

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\jenkins_home\workspace\indows-4.5-non-Arxan_release_5.5\build\x64\ReleaseProductionEnvironment\Agent\QualysAgent.pdb

Imports

advapi32

CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptVerifySignatureW
CryptDestroyKey
CryptDestroyHash
CryptReleaseContext
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey
AllocateAndInitializeSid
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RegDeleteValueW
RegCreateKeyExW
RegDeleteKeyW
RegFlushKey
GetTokenInformation
CreateProcessAsUserW
DuplicateTokenEx
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
SetNamedSecurityInfoW
InitiateSystemShutdownExW
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
CloseServiceHandle
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus
LookupAccountSidW
RegQueryInfoKeyW
RegEnumKeyExW
LookupPrivilegeValueA
CryptAcquireContextA
SystemFunction036
SetFileSecurityW
DeleteService
ControlService
StartServiceW
LsaEnumeratePrivileges
LsaEnumerateAccountsWithUserRight
RegEnumValueW
CryptImportKey
LsaLookupNames2
ConvertStringSidToSidW
ConvertSidToStringSidW
LsaQueryDomainInformationPolicy
GetNamedSecurityInfoW
QueryServiceConfigW
EnumServicesStatusExW
RegLoadKeyW
RegUnLoadKeyW
QueryServiceStatus
SetSecurityDescriptorSacl
LsaNtStatusToWinError
RegEnumKeyW
LsaClose
LsaQueryInformationPolicy
LsaOpenPolicy
LsaFreeMemory
RegOpenKeyW
CreateRestrictedToken
LogonUserW
CryptDeriveKey
CryptDecrypt
CryptEncrypt
RegNotifyChangeKeyValue
CryptGetHashParam
AbortSystemShutdownW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSecurityDescriptorToStringSecurityDescriptorW
GetSecurityInfo
RegGetKeySecurity
GetFileSecurityW

crypt32

CryptDecodeObject
CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringW
CertEnumCertificatesInStore
CertOpenSystemStoreW
CryptBinaryToStringA
CryptStringToBinaryW
CertCreateCertificateContext
CryptImportPublicKeyInfo
CertFreeCertificateContext
CertOpenStore
CertAddEncodedCertificateToStore
CertCloseStore
CryptUnprotectData
CryptMsgClose
CryptBinaryToStringW
CryptStringToBinaryA
CryptDecryptMessage
CryptMsgUpdate
CryptMsgOpenToDecode
CertGetCertificateContextProperty
CryptQueryObject

dhcpcsvc

DhcpCApiInitialize
DhcpCApiCleanup
DhcpRequestParams

iphlpapi

GetExtendedTcpTable
GetIpForwardTable
GetAdaptersInfo
GetAdaptersAddresses
GetExtendedUdpTable
GetIpAddrTable

kernel32

GetTimeZoneInformation
SetFileAttributesW
FindNextFileW
RemoveDirectoryW
FindResourceW
LoadResource
SizeofResource
LockResource
FileTimeToLocalFileTime
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
ExpandEnvironmentStringsW
GetComputerNameExW
GetCurrentProcessId
ReleaseMutex
CompareFileTime
GetWindowsDirectoryW
GetCommandLineW
CreateTimerQueueTimer
DeleteTimerQueueTimer
WTSGetActiveConsoleSessionId
OutputDebugStringW
DebugBreak
HeapSize
RaiseException
DecodePointer
HeapDestroy
OpenThread
SuspendThread
GetSystemInfo
CreateThread
GetVolumeInformationW
QueryDosDeviceW
FileTimeToSystemTime
SystemTimeToFileTime
GetTempPathW
GetCurrentProcess
OpenMutexW
VirtualQueryEx
CreateMutexA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExW
FindFirstFileExA
SetConsoleCtrlHandler
WriteConsoleW
SetStdHandle
CreateProcessA
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetACP
GetModuleFileNameA
GetCommandLineA
ReadConsoleW
GetConsoleMode
SystemTimeToTzSpecificLocalTime
GetFileType
GetCurrentDirectoryA
SetCurrentDirectoryA
SetEnvironmentVariableA
OpenEventW
GetModuleHandleExW
ExitThread
RtlUnwindEx
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
SetProcessAffinityMask
VirtualProtect
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
GetNumaHighestNodeNumber
GetLogicalProcessorInformation
GetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
InitializeSListHead
GetStartupInfoW
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
CancelWaitableTimer
RtlCaptureContext
GetLocaleInfoW
GetSystemDefaultLCID
LCMapStringW
CompareStringW
GetModuleFileNameW
FindClose
FindFirstFileW
Sleep
GetProcAddress
FreeLibrary
GetModuleHandleW
LoadLibraryW
ResumeThread
GetProcessId
CreateDirectoryW
GetProcessTimes
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCPInfo
DeleteCriticalSection
CreateWaitableTimerW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
GetLocalTime
ResetEvent
SetEvent
FormatMessageW
LocalAlloc
LocalFree
CreateEventW
GetSystemTime
SetLastError
GlobalAlloc
GlobalFree
DeleteFileW
HeapReAlloc
HeapAlloc
SetFilePointer
WaitForMultipleObjectsEx
WaitForSingleObject
GetProcessHeap
HeapFree
CloseHandle
GetFileSizeEx
GetLastError
OpenProcess
CopyFileW
GetFileAttributesW
QueueUserWorkItem
RtlCaptureStackBackTrace
EncodePointer
RtlPcToFileHeader
GetExitCodeProcess
MoveFileW
GetTempFileNameW
WaitForMultipleObjects
TerminateProcess
CreateProcessW
DisconnectNamedPipe
ReadFile
GetOverlappedResult
ConnectNamedPipe
CreateNamedPipeW
MoveFileExW
QueryPerformanceFrequency
GetNativeSystemInfo
GetExitCodeThread
GetStringTypeW
IsDebuggerPresent
FileTimeToDosDateTime
WriteFile
CreateFileW
SetWaitableTimer
ExitProcess
TerminateThread
GetCurrentDirectoryW
SetUnhandledExceptionFilter
GetConsoleCP
MultiByteToWideChar
WideCharToMultiByte
GetFullPathNameW
GetVersion
VerSetConditionMask
VerifyVersionInfoW
GetDriveTypeW
GetCurrentThread
SetThreadPriority
CreatePipe
SetHandleInformation
PeekNamedPipe
GetFileInformationByHandle
GetSystemDirectoryW
LoadLibraryExW
GetSystemTimeAsFileTime
GetFileSize
MapViewOfFile
CreateFileMappingW
FormatMessageA
LockFileEx
CreateFileMappingA
UnlockFile
HeapCompact
DeleteFileA
GetVersionExA
WaitForSingleObjectEx
LoadLibraryA
CreateFileA
FlushViewOfFile
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
UnmapViewOfFile
GetVersionExW
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
HeapCreate
AreFileApisANSI
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
InitializeCriticalSection
TryEnterCriticalSection
ReadProcessMemory
ChangeTimerQueueTimer
GetEnvironmentVariableW
SetEnvironmentVariableW
lstrcmpA
DuplicateHandle
SetFilePointerEx
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
SetThreadAffinityMask
ReleaseSemaphore
CreateSemaphoreW
LoadLibraryExA
SetErrorMode
GetComputerNameExA
Thread32First
Thread32Next
SetFileTime
GetModuleHandleA
FindCloseChangeNotification
FindFirstChangeNotificationW
GetLogicalDriveStringsW
GetStdHandle
GetProcessAffinityMask
GlobalMemoryStatusEx
AssignProcessToJobObject
CreateJobObjectW
SetInformationJobObject
ExpandEnvironmentStringsA
TerminateJobObject
MoveFileExA
WaitNamedPipeW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLongPathNameW
GetShortPathNameW
GetFileTime
DeviceIoControl
GetVolumePathNamesForVolumeNameW
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
GetPrivateProfileStringW
IsWow64Process
ReadDirectoryChangesW
GetTempFileNameA
ProcessIdToSessionId
LocalFileTimeToFileTime
ReadFileEx
WriteFileEx
SetCurrentDirectoryW
DosDateTimeToFileTime

ole32

StgIsStorageFile
OleRun
StgOpenStorage
StgOpenStorageEx
PropVariantClear
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
StgIsStorageILockBytes
IIDFromString
CoSetProxyBlanket
CoCreateInstance
CoUninitialize
CoInitializeEx
StringFromGUID2
CreateStreamOnHGlobal
CoCreateGuid
CLSIDFromString

oleaut32

SysFreeString
VariantClear
VariantInit
CreateErrorInfo
GetErrorInfo
VariantTimeToSystemTime
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
VariantCopy
SysAllocStringLen
SysStringLen
SysAllocStringByteLen
SysStringByteLen
VariantChangeType
SetErrorInfo
SysAllocString

psapi

GetModuleFileNameExW

shell32

CommandLineToArgvW
SHGetFileInfoW
SHFileOperationW
SHGetFolderPathW
SHCreateDirectoryExW

shlwapi

SHDeleteKeyW
StrChrW
PathIsDirectoryEmptyW
PathStripPathA
PathFileExistsA
PathAppendW
PathRemoveFileSpecW
StrStrIA
PathCanonicalizeW
StrStrW
PathFileExistsW
PathCombineW
PathIsDirectoryW
PathFindExtensionW
PathFindFileNameW
PathStripPathW
StrStrIW
PathIsRelativeW

user32

UnregisterClassW
PostThreadMessageW
CharUpperW
CharPrevExA
DestroyIcon
MessageBeep

winhttp

WinHttpOpenRequest
WinHttpSetOption
WinHttpGetProxyForUrl
WinHttpSendRequest
WinHttpWriteData
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpGetDefaultProxyConfiguration
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpAddRequestHeaders
WinHttpConnect
WinHttpSetTimeouts
WinHttpSetStatusCallback
WinHttpOpen
WinHttpCrackUrl

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW
WTSQueryUserToken
WTSEnumerateSessionsW

ws2_32

WSAGetLastError
WSAAddressToStringW
ntohs
WSACleanup
WSAStartup
inet_addr
WSAAddressToStringA

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

dbghelp

SymSetOptions
SymInitialize
SymCleanup
SymGetModuleInfoW64
MiniDumpWriteDump

dnsapi

DnsFree
DnsQuery_W

netapi32

NetUserGetInfo
NetLocalGroupGetMembers
NetLocalGroupEnum
NetUserModalsGet
NetUserEnum
NetApiBufferFree
NetShareEnum
NetShareGetInfo

wintrust

WinVerifyTrust
CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
CryptCATCatalogInfoFromContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminAcquireContext

ntdll

NtClose

fltlib

FilterDetach
FilterAttach
FilterSendMessage
FilterConnectCommunicationPort

Sections

.text
Size: 10.9MB - Virtual size: 10.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 190KB - Virtual size: 358KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 483KB - Virtual size: 483KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 61B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

213ff597f2d2bedc0644ac02143949f2

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

04:13:89:4d:ab:d7:6f:65:dc:b4:d0:e7:9f:01:a8:08Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

73:7c:53:a5:bd:b5:0a:b6:f1:b2:82:61:13:42:e6:94:a9:0b:32:53:cf:5c:07:ec:50:7d:e4:4c:7e:f0:e9:abSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

crypt32

dhcpcsvc

iphlpapi

kernel32

ole32

oleaut32

psapi

shell32

shlwapi

user32

winhttp

userenv

wtsapi32

ws2_32

version

dbghelp

dnsapi

netapi32

wintrust

ntdll

fltlib

Sections

.text Size: 10.9MB - Virtual size: 10.9MB

.rdata Size: 4.4MB - Virtual size: 4.4MB

.data Size: 190KB - Virtual size: 358KB

.pdata Size: 483KB - Virtual size: 483KB

.tls Size: 512B - Virtual size: 61B

.rsrc Size: 121KB - Virtual size: 120KB

.reloc Size: 51KB - Virtual size: 50KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

04:13:89:4d:ab:d7:6f:65:dc:b4:d0:e7:9f:01:a8:08
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

73:7c:53:a5:bd:b5:0a:b6:f1:b2:82:61:13:42:e6:94:a9:0b:32:53:cf:5c:07:ec:50:7d:e4:4c:7e:f0:e9:ab
Signer

.text
Size: 10.9MB - Virtual size: 10.9MB

.rdata
Size: 4.4MB - Virtual size: 4.4MB

.data
Size: 190KB - Virtual size: 358KB

.pdata
Size: 483KB - Virtual size: 483KB

.tls
Size: 512B - Virtual size: 61B

.rsrc
Size: 121KB - Virtual size: 120KB

.reloc
Size: 51KB - Virtual size: 50KB