2024-05-07_b4c34ae48faf98aae5a6d1e05266051f_ryuk

Sharing

Copy URL

Twitter E-mail

General

Target

2024-05-07_b4c34ae48faf98aae5a6d1e05266051f_ryuk
Size

1.7MB
MD5

b4c34ae48faf98aae5a6d1e05266051f
SHA1

e4908642d08c3de151c05b01b5aff22492de2bee
SHA256

774c5efad1a6c0989c1544cd5ee1e3d6de15de9617ca1b64a7a84215db158fda
SHA512

ca2225c120b5a3fb7d3c7d041c671795560e480362d8bb67a17f32d2ca7669753f3290be8261721e9a0958ee72d968492125c15cc16fa7ccceb4b3f18831ec06
SSDEEP

12288:AObLA4LWOsvAYFTDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:9/L3UTDsqjnhMgeiCl7G0nehbGZpbD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-07_b4c34ae48faf98aae5a6d1e05266051f_ryuk

Files

2024-05-07_b4c34ae48faf98aae5a6d1e05266051f_ryuk
.exe windows:6 windows x64 arch:x64

883b9c85aa02333ea08e2428bc2def05

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

ssh-agent.pdb

Imports

libcrypto

DSA_do_sign
DSA_do_verify
DSA_SIG_new
DSA_SIG_free
EVP_sha384
EVP_md5
EVP_sha256
EVP_Digest
ECDSA_SIG_new
EVP_sha1
ECDSA_SIG_free
EVP_sha512
EVP_CIPHER_CTX_key_length
EVP_CIPHER_CTX_new
EVP_aes_256_cbc
EVP_CipherInit
ECDSA_do_sign
EVP_CIPHER_CTX_set_app_data
EVP_CIPHER_CTX_get_app_data
AES_set_encrypt_key
EVP_des_ede3_cbc
EVP_aes_192_cbc
EVP_CIPHER_CTX_ctrl
EVP_CIPHER_CTX_set_key_length
AES_encrypt
RAND_bytes
ECDSA_do_verify
EVP_Cipher
EVP_aes_256_gcm
EVP_aes_128_gcm
EVP_CIPHER_CTX_free
EC_POINT_oct2point
BN_bn2bin
EC_POINT_point2oct
BN_bin2bn
RSA_public_decrypt
RSA_sign
BN_div
RSA_size
RSA_blinding_on
BN_dup
EC_GROUP_get_order
DSA_free
BN_clear_free
EC_KEY_set_private_key
BN_value_one
EC_METHOD_get_field_type
EC_POINT_mul
RSA_new
RSA_free
ERR_get_error
EC_POINT_get_affine_coordinates_GFp
EC_KEY_set_public_key
BN_free
BN_CTX_get
EC_POINT_is_at_infinity
EC_POINT_free
EVP_aes_128_cbc
EC_KEY_free
BN_CTX_start
EC_KEY_get0_public_key
DSA_new
EC_POINT_new
BN_new
EC_KEY_get0_private_key
EC_KEY_get0_group
BN_CTX_new
BN_cmp
BN_sub
BN_CTX_free
EC_GROUP_method_of
EC_KEY_new_by_curve_name
BN_num_bits

kernel32

GetCommandLineA
GetCurrentDirectoryW
SetCurrentDirectoryW
SetEnvironmentVariableW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RtlUnwindEx
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCommandLineW
LoadLibraryExW
ReadConsoleOutputA
SetConsoleCursorPosition
Beep
FillConsoleOutputAttribute
WriteConsoleOutputA
SetConsoleCursorInfo
SetConsoleWindowInfo
GetConsoleCP
GetConsoleCursorInfo
ScrollConsoleScreenBufferA
SetConsoleScreenBufferSize
SetConsoleTextAttribute
FillConsoleOutputCharacterA
CreateWaitableTimerA
WaitForSingleObjectEx
SetStdHandle
WriteConsoleW
SetConsoleCtrlHandler
GetModuleFileNameW
GetLastError
ExitProcess
GetModuleHandleExW
FindClose
FindFirstFileExW
SetHandleInformation
FindNextFileW
CreateNamedPipeW
WaitForMultipleObjects
CreateThread
GetNamedPipeClientProcessId
ExitThread
GetQueuedCompletionStatus
FreeLibraryAndExitThread
OpenProcess
HeapFree
HeapAlloc
SetEvent
CloseHandle
GetCurrentProcessId
CreateProcessW
CreateEventA
CreateIoCompletionPort
ConnectNamedPipe
ReadFile
WriteFile
GetOverlappedResult
CompareStringW
LCMapStringW
LocalFree
GetStringTypeW
GetCurrentProcess
GetStdHandle
TerminateProcess
ReadConsoleW
WaitForMultipleObjectsEx
SetEndOfFile
GetCurrentThreadId
SetFilePointerEx
GetFileType
HeapReAlloc
GetFileSizeEx
OpenThread
FlushFileBuffers
IsValidCodePage
GetConsoleScreenBufferInfo
GetACP
GetOEMCP
GetCPInfo
CreateFileW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
HeapSize
GetProcAddress
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
RaiseException
WriteFileEx
CreateFileA
SleepEx
GetLocalTime
GetConsoleMode
WaitForSingleObject
GetExitCodeProcess
QueueUserAPC
MultiByteToWideChar

advapi32

EventWrite
EventRegister
RegDeleteTreeA
RevertToSelf
RegCloseKey
RegOpenCurrentUser
RegCreateKeyExA
RegDeleteKeyExA
RegEnumKeyExW
ImpersonateLoggedOnUser
RegDeleteTreeW
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExW
CreateWellKnownSid
RegCreateKeyExW
IsWellKnownSid
RegSetValueExW
OpenProcessToken
CheckTokenMembership
DuplicateToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTokenInformation
OpenSCManagerW
SetServiceStatus
RegisterServiceCtrlHandlerW
StartServiceA
StartServiceCtrlDispatcherW
OpenServiceW

crypt32

CryptProtectData
CryptUnprotectData
CryptStringToBinaryA

ws2_32

WSAGetLastError
WSASend
WSAStartup

user32

GetWindowPlacement
FindWindowA
ShowWindow

Sections

.text
Size: 181KB - Virtual size: 181KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

883b9c85aa02333ea08e2428bc2def05

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libcrypto

kernel32

advapi32

crypt32

ws2_32

user32

Sections

.text Size: 181KB - Virtual size: 181KB

.rdata Size: 171KB - Virtual size: 170KB

.data Size: 3KB - Virtual size: 82KB

.pdata Size: 11KB - Virtual size: 10KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 1.3MB - Virtual size: 1.3MB

.text
Size: 181KB - Virtual size: 181KB

.rdata
Size: 171KB - Virtual size: 170KB

.data
Size: 3KB - Virtual size: 82KB

.pdata
Size: 11KB - Virtual size: 10KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 1.3MB - Virtual size: 1.3MB