2024-06-01_88871a1c8313809d54410480d8eeebb0_ryuk

Sharing

Copy URL

Twitter E-mail

General

Target

2024-06-01_88871a1c8313809d54410480d8eeebb0_ryuk
Size

636KB
MD5

88871a1c8313809d54410480d8eeebb0
SHA1

a05919959fbcf380797ab94328a4b58fde47fc84
SHA256

ee7fbe2df413a74770405220a736ccbfec686f1374e938cc9e6aef9481e7b988
SHA512

3b7e1c3846213e3a5ebaaa18d3b6283c862d0520c22eab1f34c1bc7fe041fa24d0347aff8895ac7e30ca22fcf7a96a6e714432de734720e7093963c8f9402a32
SSDEEP

12288:cUvoTKjFyUWiJ86aAXfFqWPw2s7WDEYC0:BATKjFyUWiJ86nTPFs7s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-01_88871a1c8313809d54410480d8eeebb0_ryuk

Files

2024-06-01_88871a1c8313809d54410480d8eeebb0_ryuk
.exe windows:6 windows x64 arch:x64

e8df3d4449069d3ae79b5fb30c992baf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\C-DEV\QLSI\bin\Intel C++ Compiler 16.0\Kunde Unicode\x64\spmtable.pdb

Imports

libiomp5md

ord120
ord110

wsock32

WSAStartup
WSACleanup
socket
gethostbyname
connect
setsockopt
shutdown
closesocket
__WSAFDIsSet
send
select
recv
WSAGetLastError
gethostname

kernel32

RaiseException
ReadConsoleW
ReadFile
SetEndOfFile
WriteConsoleW
SetFilePointerEx
HeapReAlloc
HeapSize
CreateFileW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
FindNextFileW
FindNextFileA
FindFirstFileExW
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
FormatMessageA
LoadLibraryA
GetThreadLocale
InitializeCriticalSection
LoadLibraryExA
LeaveCriticalSection
GetProcAddress
GetModuleHandleExA
GetEnvironmentVariableA
EnterCriticalSection
RtlUnwindEx
GetLastError
GetModuleFileNameW
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
WriteFile
GetModuleFileNameA
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
GetCurrentThread
GetFileType
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
CloseHandle
GetStringTypeW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetProcessHeap
SetConsoleCtrlHandler
OutputDebugStringA
OutputDebugStringW
WaitForSingleObjectEx
CreateThread
FindClose
FindFirstFileExA

advapi32

SystemFunction036

Sections

.text
Size: 501KB - Virtual size: 500KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 283B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.debug_o
Size: 1024B - Virtual size: 1013B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e8df3d4449069d3ae79b5fb30c992baf

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libiomp5md

wsock32

kernel32

advapi32

Sections

.text Size: 501KB - Virtual size: 500KB

.rdata Size: 93KB - Virtual size: 92KB

.data Size: 6KB - Virtual size: 21KB

.pdata Size: 23KB - Virtual size: 22KB

.idata Size: 5KB - Virtual size: 5KB

.00cfg Size: 512B - Virtual size: 283B

.debug_o Size: 1024B - Virtual size: 1013B

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 501KB - Virtual size: 500KB

.rdata
Size: 93KB - Virtual size: 92KB

.data
Size: 6KB - Virtual size: 21KB

.pdata
Size: 23KB - Virtual size: 22KB

.idata
Size: 5KB - Virtual size: 5KB

.00cfg
Size: 512B - Virtual size: 283B

.debug_o
Size: 1024B - Virtual size: 1013B

.reloc
Size: 5KB - Virtual size: 4KB