2024-05-14_df107fc61e6a470cce2befaed44dfe2d_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-14_df107fc61e6a470cce2befaed44dfe2d_ryuk
Size

2.0MB
MD5

df107fc61e6a470cce2befaed44dfe2d
SHA1

615b93d45f07d5fe0c74e5342c6ae1356ab1e0d4
SHA256

56d4ed5bf9c8b1cb1bc0f8d290d116c3d1792886eba2aea390ea5da5c434156f
SHA512

3b2d21b0e979ae5ccd61361d13909bbdf623041150bbfc44745d6a88e2ebefbc6dd2d8d49f93d46547463177522cd97ca04adade37c4380715f8be9e0320e8e9
SSDEEP

49152:pypMU9uCLlAaTzBXnolGCQy9RzVakfCrlYWGjBbdSiIypMU9uCLlf:pypMpCLl5YlGCQKRzVaqCrlTIYypMpCd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-14_df107fc61e6a470cce2befaed44dfe2d_ryuk

Files

2024-05-14_df107fc61e6a470cce2befaed44dfe2d_ryuk
.exe windows:6 windows x64 arch:x64

5ce85084191be301fa076e5f6fc85f6b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

ssh-add.pdb

Imports

libcrypto

AES_set_encrypt_key
EVP_CIPHER_CTX_get_app_data
EVP_CIPHER_CTX_set_app_data
ECDSA_SIG_free
AES_encrypt
ECDSA_SIG_new
DSA_do_verify
DSA_SIG_new
DSA_SIG_free
EVP_CIPHER_CTX_key_length
EVP_CIPHER_CTX_new
EVP_aes_256_cbc
ECDSA_do_verify
EVP_CipherInit
EVP_des_ede3_cbc
EVP_aes_192_cbc
EVP_CIPHER_CTX_ctrl
EVP_CIPHER_CTX_set_key_length
EVP_Cipher
EVP_aes_256_gcm
EVP_aes_128_gcm
EVP_CIPHER_CTX_free
EC_POINT_oct2point
BN_bn2bin
EC_POINT_point2oct
BN_bin2bn
BN_init
RSA_public_decrypt
BN_div
RSA_size
EVP_sha384
EVP_md5
EVP_sha256
EVP_Digest
EVP_sha1
EVP_sha512
RAND_status
SSLeay
RSA_blinding_on
EC_GROUP_get_order
DSA_free
BIO_new
EC_POINT_cmp
BN_clear_free
ERR_peek_error
EC_KEY_set_private_key
BN_value_one
EVP_PKEY_get1_EC_KEY
EC_METHOD_get_field_type
EC_POINT_mul
RSA_new
RSA_free
BN_copy
ERR_get_error
EC_POINT_get_affine_coordinates_GFp
ERR_peek_last_error
EC_KEY_set_public_key
BN_CTX_get
EC_KEY_set_group
EC_POINT_is_at_infinity
BIO_s_mem
PEM_read_bio_PrivateKey
EC_POINT_free
EVP_aes_128_cbc
EC_KEY_free
BN_CTX_start
EVP_PKEY_free
EVP_PKEY_get1_RSA
EC_KEY_get0_public_key
EC_GROUP_free
DSA_new
EC_POINT_new
BIO_write
BIO_free
EC_GROUP_cmp
EVP_PKEY_get1_DSA
EC_GROUP_set_asn1_flag
EC_GROUP_get_curve_name
BN_new
EC_KEY_get0_private_key
EC_KEY_get0_group
BN_CTX_new
BN_cmp
BN_sub
EC_GROUP_new_by_curve_name
BN_CTX_free
EC_GROUP_method_of
EC_KEY_new_by_curve_name
BN_num_bits
OPENSSL_add_all_algorithms_noconf

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineA
GetCommandLineW
SetStdHandle
ExpandEnvironmentStringsW
SetEnvironmentVariableW
GetCurrentDirectoryW
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetEnvironmentVariableA

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetWindowsDirectoryW
GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-security-base-l1-1-0

CopySid
GetLengthSid
EqualSid
GetAce
GetTokenInformation
IsValidAcl
IsWellKnownSid
IsValidSid
IsValidSecurityDescriptor

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW
LookupAccountNameW

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW
CreateNamedPipeA

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-file-l1-1-0

GetDriveTypeW
CreateFileA
GetFinalPathNameByHandleW
SetFilePointerEx
GetFileAttributesExW
GetFileInformationByHandle
FindClose
FlushFileBuffers
WriteFileEx
GetFullPathNameW
GetFullPathNameA
FindFirstFileExW
FindNextFileW
WriteFile
ReadFile
GetFileType
CreateFileW
ReadFileEx
SetEndOfFile

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle
SetHandleInformation

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SleepEx
SetEvent
WaitForMultipleObjectsEx
WaitForSingleObjectEx
EnterCriticalSection
WaitForSingleObject
ResetEvent
CreateEventA

api-ms-win-core-processthreads-l1-1-0

TerminateThread
TlsAlloc
GetCurrentProcessId
TerminateProcess
TlsGetValue
TlsSetValue
TlsFree
OpenProcessToken
GetCurrentProcess
CreateThread
ExitThread
GetExitCodeProcess
GetStartupInfoW
QueueUserAPC
GetCurrentThreadId
CreateProcessW
CreateProcessAsUserW
OpenThread
ExitProcess

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleHandleExW
GetProcAddress
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
FreeLibraryAndExitThread

api-ms-win-core-console-l2-1-0

GetConsoleCursorInfo
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
SetConsoleScreenBufferSize
FillConsoleOutputCharacterA
WriteConsoleOutputA
SetConsoleCursorPosition
ReadConsoleOutputA
SetConsoleCursorInfo
ScrollConsoleScreenBufferA
SetConsoleWindowInfo
FillConsoleOutputAttribute

api-ms-win-security-provider-l1-1-0

GetNamedSecurityInfoW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent

crypt32

CryptBinaryToStringA
CryptStringToBinaryA

ws2_32

WSASend
WSARecv
WSAIoctl
WSAGetOverlappedResult
WSACleanup
WSADuplicateSocketW
WSAGetLastError
WSAStartup
closesocket
socket
setsockopt
bind
getsockname
WSASocketW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
CompareStringW

api-ms-win-core-io-l1-1-0

DeviceIoControl
CancelIoEx

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-core-console-l1-1-0

SetConsoleCtrlHandler
ReadConsoleInputW
WriteConsoleW
ReadConsoleW
GetNumberOfConsoleInputEvents
GetConsoleCP
PeekConsoleInputA
ReadConsoleInputA
GetConsoleMode
SetConsoleMode

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-synch-ansi-l1-1-0

CreateWaitableTimerA

api-ms-win-core-util-l1-1-0

Beep

api-ms-win-core-localization-l1-2-0

GetOEMCP
IsValidCodePage
GetACP
GetCPInfo
LCMapStringW

api-ms-win-security-sddl-ansi-l1-1-0

ConvertSidToStringSidA

user32

FindWindowA
GetWindowPlacement
ShowWindow

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap
HeapReAlloc
HeapSize

Sections

.text
Size: 262KB - Virtual size: 262KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 179KB - Virtual size: 179KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5ce85084191be301fa076e5f6fc85f6b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libcrypto

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-console-l2-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-core-debug-l1-1-0

crypt32

ws2_32

api-ms-win-core-string-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-console-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-synch-ansi-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-security-sddl-ansi-l1-1-0

user32

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-heap-l1-1-0

Sections

.text Size: 262KB - Virtual size: 262KB

.rdata Size: 179KB - Virtual size: 179KB

.data Size: 20KB - Virtual size: 35KB

.pdata Size: 13KB - Virtual size: 12KB

.rsrc Size: 1024B - Virtual size: 976B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 262KB - Virtual size: 262KB

.rdata
Size: 179KB - Virtual size: 179KB

.data
Size: 20KB - Virtual size: 35KB

.pdata
Size: 13KB - Virtual size: 12KB

.rsrc
Size: 1024B - Virtual size: 976B

.reloc
Size: 2KB - Virtual size: 2KB