2024-05-12_c61919b13417aeb79111778ab65275ce_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-12_c61919b13417aeb79111778ab65275ce_ryuk
Size

1.1MB
MD5

c61919b13417aeb79111778ab65275ce
SHA1

694ed4bb3baf999fc4c7c2fe9fd6b46f26d90d97
SHA256

dbd65f07f2e4ac32335a52782aa4c3c2479ae9de331229d527188b2789c050d3
SHA512

27ca6929873b0b3c5eac039b17739118768e6fa33a9a05c7acb351d22ff4fbff893b3b4422cfbd526bb8e36b02785b2804ff46c3514b1e476e7134c9d801ba5e
SSDEEP

12288:65Cn0MOJ9yfliVasITgdKKC7fnvq8zpm7SBBnq1T+62gKLlHkcAorwO4:65HHKliVAvvq8zpoSBBnUTDRKLlHkcA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-12_c61919b13417aeb79111778ab65275ce_ryuk

Files

2024-05-12_c61919b13417aeb79111778ab65275ce_ryuk
.exe windows:6 windows x64 arch:x64

5f19ca34b3a0aaaa97d9f440dd0d8e64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

bthprops.cpl

BluetoothFindRadioClose
BluetoothGetRadioInfo
BluetoothFindFirstRadio

setupapi

SetupDiEnumDeviceInfo
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList

hid

HidD_SetOutputReport

kernel32

ReadConsoleW
SetStdHandle
GetOEMCP
IsValidCodePage
HeapSize
FindFirstFileExA
GetProcessHeap
FindNextFileA
CreateFileA
ReadFile
WriteFile
CloseHandle
GetLastError
GetOverlappedResult
DeviceIoControl
CancelIo
ResetEvent
WaitForSingleObject
CreateEventA
FreeLibrary
GetProcAddress
LocalFree
FormatMessageW
LoadLibraryA
QueryPerformanceCounter
QueryPerformanceFrequency
GetModuleHandleA
RaiseException
Sleep
GetCurrentThreadId
GetSystemTimeAsFileTime
TlsSetValue
CreateMutexW
ReleaseMutex
CreateEventW
SetEvent
TlsAlloc
SleepEx
TlsGetValue
TlsFree
EnterCriticalSection
GetCurrentProcess
WaitForMultipleObjects
LeaveCriticalSection
InitializeCriticalSection
DuplicateHandle
DeleteCriticalSection
VerifyVersionInfoA
ReleaseSemaphore
GetVersionExA
VerSetConditionMask
GetCurrentProcessId
CreateSemaphoreA
SetThreadAffinityMask
GetProcessAffinityMask
TerminateThread
FormatMessageA
CreateDirectoryW
CreateFileW
FindClose
GetFileAttributesW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetEnvironmentStringsW
GetDateFormatW
GetACP
GetCommandLineW
GetCommandLineA
ExitProcess
SetEnvironmentVariableA
FreeEnvironmentStringsW
TryEnterCriticalSection
WaitForSingleObjectEx
GetCurrentThread
GetExitCodeThread
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
GetTickCount
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
RegisterWaitForSingleObject
UnregisterWait
OutputDebugStringW
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
RtlPcToFileHeader
RtlUnwindEx
GetStdHandle
GetFileType
GetModuleFileNameA
GetModuleHandleExW
WriteConsoleW
ExitThread
HeapAlloc
HeapFree
HeapReAlloc

user32

DispatchMessageA
TranslateMessage
GetMessageA
GetActiveWindow
GetRawInputDeviceInfoA
GetRawInputDeviceList
PeekMessageA

Exports

Exports

hid_close
hid_enumerate
hid_error
hid_exit
hid_free_enumeration
hid_get_feature_report
hid_get_indexed_string
hid_get_manufacturer_string
hid_get_product_string
hid_get_serial_number_string
hid_init
hid_open
hid_open_path
hid_read
hid_read_timeout
hid_send_feature_report
hid_set_nonblocking
hid_write

Sections

.text
Size: 739KB - Virtual size: 739KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 269KB - Virtual size: 269KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5f19ca34b3a0aaaa97d9f440dd0d8e64

Headers

DLL Characteristics

File Characteristics

Imports

bthprops.cpl

setupapi

hid

kernel32

user32

Exports

Exports

Sections

.text Size: 739KB - Virtual size: 739KB

.rdata Size: 269KB - Virtual size: 269KB

.data Size: 22KB - Virtual size: 58KB

.pdata Size: 38KB - Virtual size: 38KB

.gfids Size: 4KB - Virtual size: 3KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 739KB - Virtual size: 739KB

.rdata
Size: 269KB - Virtual size: 269KB

.data
Size: 22KB - Virtual size: 58KB

.pdata
Size: 38KB - Virtual size: 38KB

.gfids
Size: 4KB - Virtual size: 3KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 7KB - Virtual size: 6KB