2024-06-03_ecadb0f3b6629e83a6c837a6283f9112_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-03_ecadb0f3b6629e83a6c837a6283f9112_ryuk
Size 9.4MB
Sample240603-kpy73aaf97
SHA256 084b5640e01734707899b3d944d7afdb90259af4e2353e22a3c1d590c703dcf7
MD5 ecadb0f3b6629e83a6c837a6283f9112
SHA1 a5a667ccbb9ce76135ce111289a8b9b0aefd935b
SHA512 2b179109e75bc0e0798d42c7e4ecd069cffbbe1df254d5b48672eaf1f109344933ac9d6a839939c9005af0731b246aa6e7e6b53ec46ae0f9fa285b33dd0090d8
SSDEEP 98304:+5Mq3hSv9I0XEvVHhp1kFCGYlN+tB6niAJuks8jzkHs/qMhvgeFu4zNSjAo:+Mq3aYHhpwT8jVq+YeFzNSf
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-06-03_ecadb0f3b6629e83a6c837a6283f9112_ryuk

.exe 9.4MB

2024-06-03_ecadb0f3b6629e83a6c837a6283f9112_ryuk

IMPHASH e3bf031fb50cc5faadaf84840b0443e6
SHA256 084b5640e01734707899b3d944d7afdb90259af4e2353e22a3c1d590c703dcf7
MD5 ecadb0f3b6629e83a6c837a6283f9112
SHA1 a5a667ccbb9ce76135ce111289a8b9b0aefd935b
SHA512 2b179109e75bc0e0798d42c7e4ecd069cffbbe1df254d5b48672eaf1f109344933ac9d6a839939c9005af0731b246aa6e7e6b53ec46ae0f9fa285b33dd0090d8
SSDEEP 98304:+5Mq3hSv9I0XEvVHhp1kFCGYlN+tB6niAJuks8jzkHs/qMhvgeFu4zNSjAo:+Mq3aYHhpwT8jVq+YeFzNSf
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

ba:02:1b:7d:60:68:2f:89:09:83:ee:e9:82:35:15:69:22:42:bf:89:17:ef:95:7e:d0:f4:f9:9d:3a:85:f4:aa

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Sublime HQ Pty Ltd,O=Sublime HQ Pty Ltd,L=Woollahra,ST=New South Wales,C=AU

Chains

Nov 23, 2023

Minor OS version

Major OS version

Entry point

6441292

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

/home/jskinner/.release_build/build/gn/lto_win_x64/sublime_text.pdb

wininet

HttpOpenRequestW HttpQueryInfoW HttpSendRequestW InternetCloseHandle InternetConnectW InternetOpenW InternetReadFile

user32

AdjustWindowRectEx AllowSetForegroundWindow AppendMenuW BeginDeferWindowPos BeginPaint CheckMenuItem ClientToScreen CloseClipboard CopyRect CreateCaret CreateMenu CreatePopupMenu CreateWindowExW DefWindowProcW DeferWindowPos DestroyCaret DestroyMenu DestroyWindow DispatchMessageW EmptyClipboard EnableMenuItem EnableWindow EndDeferWindowPos EndPaint EnumClipboardFormats EnumDisplayMonitors FillRect GetActiveWindow GetCapture GetCaretBlinkTime GetClassInfoExW GetClientRect GetClipboardData GetClipboardFormatNameW GetCursorPos GetDC GetDCEx GetDoubleClickTime GetFocus GetIconInfo GetKeyState GetMenu GetMenuItemCount GetMenuItemID GetMessageTime GetMonitorInfoW GetParent GetSubMenu GetSysColor GetSystemMenu GetSystemMetrics GetUpdateRgn GetWindowLongPtrW GetWindowLongW GetWindowPlacement GetWindowRect HideCaret InsertMenuW InvalidateRect IsIconic IsWindowVisible KillTimer LoadCursorW MessageBoxW ModifyMenuW MonitorFromPoint MonitorFromRect MonitorFromWindow MsgWaitForMultipleObjectsEx OpenClipboard PeekMessageW PostMessageW PostQuitMessage PostThreadMessageW PtInRect RegisterClassExW RegisterClipboardFormatA RegisterClipboardFormatW ReleaseCapture ReleaseDC RemoveMenu ScreenToClient SendInput SendMessageW SetCapture SetCaretPos SetClipboardData SetCursor SetFocus SetForegroundWindow SetMenu SetMenuDefaultItem SetMenuInfo SetMenuItemInfoW SetScrollInfo SetTimer SetWindowLongW SetWindowPlacement SetWindowPos SetWindowTextW ShowCursor ShowWindow SystemParametersInfoW TrackMouseEvent TrackPopupMenu TrackPopupMenuEx TranslateMessage UpdateLayeredWindow wsprintfA wsprintfW

ole32

CoCreateInstance CoInitialize CoLockObjectExternal CoTaskMemFree DoDragDrop OleInitialize RegisterDragDrop ReleaseStgMedium RevokeDragDrop

kernel32

AcquireSRWLockExclusive CancelIo CloseHandle CompareStringW ConnectNamedPipe CopyFileW CreateDirectoryW CreateEventA CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateNamedPipeA CreateNamedPipeW CreateProcessW CreateSemaphoreW CreateThread DecodePointer DeleteCriticalSection DeleteFileW DeviceIoControl EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FileTimeToSystemTime FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileTime GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetLongPathNameW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNamedPipeClientProcessId GetNamedPipeServerProcessId GetNativeSystemInfo GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetProcessTimes GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTime GetSystemTimeAsFileTime GetTempPathW GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVersion GetVersionExW GetVolumeInformationByHandleW GlobalAlloc GlobalLock GlobalSize GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceBeginInitialize InitOnceComplete InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalAlloc LocalFree LockFile LockFileEx MapViewOfFile MoveFileExW MoveFileW MulDiv MultiByteToWideChar OpenEventW OpenFileMappingW OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadDirectoryChangesW ReadFile ReleaseSRWLockExclusive ReleaseSemaphore RemoveDirectoryW ReplaceFileW ResetEvent RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointerEx SetHandleInformation SetLastError SetNamedPipeHandleState SetPriorityClass SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableCS SleepConditionVariableSRW SleepEx SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TransactNamedPipe TryAcquireSRWLockExclusive UnhandledExceptionFilter UnlockFile UnlockFileEx UnmapViewOfFile WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WaitNamedPipeA WaitNamedPipeW WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

advapi32

BuildExplicitAccessWithNameW BuildSecurityDescriptorW ConvertStringSecurityDescriptorToSecurityDescriptorW GetTokenInformation OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

comdlg32

ChooseFontW CommDlgExtendedError GetOpenFileNameW GetSaveFileNameW

gdi32

BitBlt ChoosePixelFormat CombineRgn CreateCompatibleDC CreateDIBSection CreateFontIndirectW CreateRectRgn CreateSolidBrush DeleteDC DeleteObject DescribePixelFormat EnumFontFamiliesExW GetCurrentObject GetDIBits GetDeviceCaps GetObjectW GetRegionData GetStockObject GetTextExtentPointW GetTextMetricsW Rectangle SelectClipRgn SelectObject SetBkMode SetDCBrushColor SetDCPenColor SetPixelFormat SetTextColor TextOutW

comctl32

ord345

shell32

CommandLineToArgvW DragAcceptFiles DragQueryFileW ExtractIconExW ord190 ord155 SHAddToRecentDocs SHBrowseForFolderW SHCreateItemFromParsingName ord74 SHFileOperationW SHGetFolderPathW SHGetPathFromIDListW SHOpenFolderAndSelectItems ShellExecuteW

imm32

ImmGetCompositionStringW ImmGetContext ImmNotifyIME ImmReleaseContext ImmSetCandidateWindow

opengl32

glBindTexture glBlendFunc glClear glClearColor glDeleteTextures glDisable glDrawArrays glDrawElements glEnable glFlush glGenTextures glGetError glGetString glPixelStorei glScissor glTexImage2D glTexParameteri glTexSubImage2D glViewport wglCreateContext wglDeleteContext wglMakeCurrent wglShareLists

dwmapi

DwmEnableBlurBehindWindow DwmExtendFrameIntoClientArea DwmFlush DwmGetColorizationColor DwmGetCompositionTimingInfo DwmIsCompositionEnabled DwmSetWindowAttribute

uxtheme

DrawThemeTextEx GetThemeSysFont OpenThemeData

Name

.text

Size

6.1MB

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

442KB

Virtual Size

523KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

369KB

Virtual Size

369KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

48B

Characteristics

Name

.tls

Size

512B

Virtual Size

65B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

119KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2024-06-03_ecadb0f3b6629e83a6c837a6283f9112_ryuk

PE Signature issue

wininet

user32

ole32

kernel32

advapi32

comdlg32

gdi32

comctl32

shell32

imm32

opengl32

dwmapi

uxtheme

generic