2024-05-14_2aa6be83c8e6afb5f91824be67975c7b_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-14_2aa6be83c8e6afb5f91824be67975c7b_ryuk
Size

1.6MB
MD5

2aa6be83c8e6afb5f91824be67975c7b
SHA1

4608f0e8d524885996dca3cb539f0008b2276989
SHA256

8bf67c4aad38691bc67d7b48466fcae23cfb5d49e03ff3646ef03a80a50e37b6
SHA512

fa4b544a01462e5527f9b8e0f36397bbc8f2cb5c5a97339998c060f7bb0266e6dcf45058b19b879b96c206cb2207bc809d54c1b35e831067831d4f20e5493b7f
SSDEEP

24576:w3K7IodOPhE9gk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:woHahE9nLNiXicJFFRGNzj3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-14_2aa6be83c8e6afb5f91824be67975c7b_ryuk

Files

2024-05-14_2aa6be83c8e6afb5f91824be67975c7b_ryuk
.exe windows:6 windows x64 arch:x64

b45ae68bf62b66c621cb702832e4dcdf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

f:\BluetoothDrvWin10RS3.19\sw\src\Maglev_10_0_rs3\App\Bin\x64\Release\AdminService.pdb

Imports

bluetoothapis

BluetoothSetLocalServiceInfo
BluetoothFindRadioClose
BluetoothGetRadioInfo
BluetoothFindFirstRadio

ole32

StringFromGUID2
CLSIDFromString

shlwapi

StrCmpW
PathRemoveFileSpecW

cfgmgr32

CM_Get_DevNode_Status_Ex
CM_Get_Device_ID_ExW
CM_Disconnect_Machine
CM_Locate_DevNode_ExW
CM_Connect_MachineW
CM_Get_DevNode_Status
CM_Get_Next_Res_Des_Ex
CM_Get_Res_Des_Data_Ex
CM_Get_First_Log_Conf_Ex
CM_Get_Res_Des_Data_Size_Ex
CM_Free_Res_Des_Handle
CM_Free_Log_Conf_Handle
CM_Reenumerate_DevNode_Ex

setupapi

SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiCreateDeviceInfoW
SetupDiGetClassDescriptionExW
SetupDiBuildClassInfoListExW
SetupDiClassGuidsFromNameExW
SetupDiSetDeviceRegistryPropertyW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsExW
SetupDiSetClassInstallParamsW
SetupDiGetDeviceInfoListDetailW
SetupDiCallClassInstaller
SetupDiGetINFClassW
SetupDiCreateDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInstallParamsW
SetupDiGetDriverInstallParamsW
SetupFindFirstLineW
SetupDiSetDeviceInstallParamsW
SetupOpenInfFileW
SetupGetStringFieldW
SetupDiBuildDriverInfoList
SetupDiGetDriverInfoDetailW
SetupDiEnumDriverInfoW
SetupDiDestroyDriverInfoList
SetupCloseInfFile
SetupDiOpenDeviceInfoW
SetupDiGetDeviceRegistryPropertyW
SetupDiCreateDeviceInfoListExW
SetupDiClassNameFromGuidExW
SetupCopyOEMInfW
SetupDiOpenClassRegKeyExW

powrprof

CallNtPowerInformation

kernel32

GetACP
GetCommandLineW
GetCommandLineA
GetStdHandle
MultiByteToWideChar
GetModuleHandleExW
SetLastError
RtlUnwindEx
LoadLibraryExW
TlsFree
TlsSetValue
ReadFile
FindFirstFileW
SetLocalTime
GetCurrentProcess
SetDynamicTimeZoneInformation
DeviceIoControl
GetModuleFileNameW
FindClose
WaitForSingleObject
CreateFileW
OpenEventW
ResumeThread
CreateEventW
GetExitCodeThread
Sleep
GetLastError
OutputDebugStringW
SetEvent
FileTimeToSystemTime
TerminateThread
GetEnvironmentStringsW
DeleteFileW
GlobalFree
CloseHandle
LoadLibraryW
CreateThread
ResetEvent
GetLocalTime
GetProcAddress
GlobalLock
ExitProcess
SystemTimeToFileTime
GetModuleHandleW
GetTickCount
GlobalUnlock
GetFullPathNameW
FindNextFileW
lstrlenW
GetFileAttributesW
GetWindowsDirectoryW
SizeofResource
HeapFree
GetSystemPowerStatus
InitializeCriticalSectionEx
GetVersionExW
HeapSize
GetPrivateProfileStringW
LockResource
HeapReAlloc
RaiseException
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
HeapDestroy
DeleteCriticalSection
GetProcessHeap
GetPrivateProfileSectionW
GetNativeSystemInfo
FormatMessageW
LocalFree
GetDateFormatW
WideCharToMultiByte
WriteFile
GetCurrentThreadId
GetCurrentProcessId
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
RtlPcToFileHeader
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetFileType
CompareStringW
LCMapStringW
GetStringTypeW
GetExitCodeProcess
CreateProcessA
GetFileAttributesExW
FindFirstFileExW
IsValidCodePage
GetOEMCP
FreeLibrary
GetCPInfo
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
GlobalAlloc
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WaitForSingleObjectEx
EnterCriticalSection
LeaveCriticalSection

user32

DispatchMessageW
GetMessageW
TranslateMessage
CharPrevW
UnregisterDeviceNotification
LoadStringW
RegisterDeviceNotificationW
PostThreadMessageW
CharNextW

advapi32

RegEnumValueW
OpenServiceW
RegDeleteValueW
StartServiceCtrlDispatcherW
RegQueryValueExA
RegOpenKeyExA
InitiateSystemShutdownExW
QueryServiceStatus
RegDeleteKeyExW
RegEnumKeyExW
LookupPrivilegeValueW
RegisterServiceCtrlHandlerExW
AdjustTokenPrivileges
CreateServiceW
RegCloseKey
RegQueryInfoKeyW
CloseServiceHandle
OpenSCManagerW
SetServiceStatus
ChangeServiceConfig2W
RegCreateKeyExW
DeleteService
ControlService
RegDeleteTreeW
RegSetValueExW
OpenProcessToken
StartServiceW
RegOpenKeyExW
RegGetValueW
RegQueryValueExW

shell32

ShellExecuteW
SHGetSpecialFolderPathW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

Sections

.text
Size: 223KB - Virtual size: 222KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b45ae68bf62b66c621cb702832e4dcdf

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bluetoothapis

ole32

shlwapi

cfgmgr32

setupapi

powrprof

kernel32

user32

advapi32

shell32

version

Sections

.text Size: 223KB - Virtual size: 222KB

.rdata Size: 101KB - Virtual size: 101KB

.data Size: 4KB - Virtual size: 10KB

.pdata Size: 11KB - Virtual size: 10KB

.gfids Size: 512B - Virtual size: 236B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 47KB - Virtual size: 46KB

.reloc Size: 1.2MB - Virtual size: 1.9MB

.text
Size: 223KB - Virtual size: 222KB

.rdata
Size: 101KB - Virtual size: 101KB

.data
Size: 4KB - Virtual size: 10KB

.pdata
Size: 11KB - Virtual size: 10KB

.gfids
Size: 512B - Virtual size: 236B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 47KB - Virtual size: 46KB

.reloc
Size: 1.2MB - Virtual size: 1.9MB