2024-06-03_bf194039ff2e6ae14f3af0a524d9b54f_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-03_bf194039ff2e6ae14f3af0a524d9b54f_ryuk
Size 1.1MB
Sample240603-jktaksgd2y
SHA256 f619d0b3ea2f5cb79cb312cb03e0c7596ed8c46342e0600ca06be27c79903f84
MD5 bf194039ff2e6ae14f3af0a524d9b54f
SHA1 8b318747a496ec5ccbe2d83f5beb39b8c9b79135
SHA512 5007bd41e83ac834fafa151dd753cc93ae589d75bf03c83794d51dee0278fc26521941ecdb91faf16704b6df1935a1b7e03feeee373d2c2c96212bed79842fab
SSDEEP 24576:GLhGkEi8j/eWRwc/J213mDnfuBFDXPkO1SkQ/7Gb8NLEbeZ:+hGV/eWRwc/o13mDGBFDSkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-03_bf194039ff2e6ae14f3af0a524d9b54f_ryuk

File Explorer

2024-06-03_bf194039ff2e6ae14f3af0a524d9b54f_ryuk

.exe 1.1MB

2024-06-03_bf194039ff2e6ae14f3af0a524d9b54f_ryuk

IMPHASH b6cf226307a5f95763025e2880cdd028
SHA256 f619d0b3ea2f5cb79cb312cb03e0c7596ed8c46342e0600ca06be27c79903f84
MD5 bf194039ff2e6ae14f3af0a524d9b54f
SHA1 8b318747a496ec5ccbe2d83f5beb39b8c9b79135
SHA512 5007bd41e83ac834fafa151dd753cc93ae589d75bf03c83794d51dee0278fc26521941ecdb91faf16704b6df1935a1b7e03feeee373d2c2c96212bed79842fab
SSDEEP 24576:GLhGkEi8j/eWRwc/J213mDnfuBFDXPkO1SkQ/7Gb8NLEbeZ:+hGV/eWRwc/o13mDGBFDSkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

363008

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb

kernel32

GetCurrentProcess DeviceIoControl FindClose SetFileTime CloseHandle BackupRead BackupSeek CreateDirectoryW RemoveDirectoryW CreateFileW DeleteFileW FindFirstFileW CreateHardLinkW GetShortPathNameW GetLongPathNameW MoveFileW ReadFile FlushFileBuffers SetEndOfFile SetFilePointer GetFileTime GetCurrentProcessId GetDriveTypeW GetDiskFreeSpaceExW SetFileAttributesW GetFileAttributesW GetVolumeInformationW ExpandEnvironmentStringsW FindNextFileW GetVersionExW GetModuleFileNameW GetCurrentDirectoryW GetFullPathNameW FoldStringW SetErrorMode FreeLibrary LoadLibraryW LoadLibraryExW CompareStringA GetCurrentThread SetThreadPriority SetConsoleCtrlHandler CreateEventW GetSystemDirectoryW SetCurrentDirectoryW GetFullPathNameA SetPriorityClass GetProcessAffinityMask CreateThread InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent ReleaseSemaphore WaitForSingleObject CreateSemaphoreW GetSystemTime SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToLocalFileTime LocalFileTimeToFileTime FileTimeToSystemTime GetCPInfo IsDBCSLeadByte MultiByteToWideChar WideCharToMultiByte CompareStringW SetFilePointerEx HeapSize GetProcessHeap SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindNextFileA FormatMessageW Sleep GetLastError WriteConsoleW ReadConsoleW SetConsoleMode GetConsoleMode WriteFile GetStdHandle GetFileType GetCommandLineW GetModuleHandleW GetProcAddress GetFileInformationByHandle SetThreadExecutionState SetLastError FindFirstFileExA SetStdHandle GetConsoleCP RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent WaitForSingleObjectEx IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW QueryPerformanceFrequency GetModuleFileNameA GetCommandLineA GetACP HeapFree HeapAlloc HeapReAlloc GetStringTypeW LCMapStringW

user32

CharLowerW CharUpperW MessageBeep ExitWindowsEx CharLowerA LoadStringW CharToOemBuffW OemToCharBuffA OemToCharA CharToOemA CharToOemBuffA

advapi32

FreeSid AllocateAndInitializeSid RegQueryValueExW RegOpenKeyExW RegCloseKey LookupPrivilegeValueW GetFileSecurityW SetFileSecurityW GetSecurityDescriptorLength AdjustTokenPrivileges OpenProcessToken CryptGenRandom CryptReleaseContext CryptAcquireContextW CheckTokenMembership

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetMalloc SHFileOperationW

powrprof

SetSuspendState

Name

.text

Size

433KB

Virtual Size

432KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

85KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

216B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2024-06-03_bf194039ff2e6ae14f3af0a524d9b54f_ryuk

kernel32

user32

advapi32

shell32

powrprof

generic