2024-06-05_e9f5e496ba93b2dca750c40ab35117e4_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-05_e9f5e496ba93b2dca750c40ab35117e4_ryuk
Size

9.5MB
MD5

e9f5e496ba93b2dca750c40ab35117e4
SHA1

dec83c2430ff2f06fa52b058a2c85f4a7649dfcb
SHA256

969927038ccfa21133ce6dbe4717f4a8e7cf1b4d8f34cd73e7df71b7541ce1a1
SHA512

c7b51f8bd433d46c0ff7b310c99d1693ef6644d591650cfa42b8f32919391608caa85170291a26a0032fd1482464329a59ddecf851432f6f8d8bd21a517531a8
SSDEEP

98304:Agjjn4nuitPmG1mPKSHziHUvh9VUVKMiRHVH9ZJ6kCMbl2/1rqN/JtXz0PRTfmrp:djLymFPpTiHUvTyVv/1rqNxpwTvz+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-05_e9f5e496ba93b2dca750c40ab35117e4_ryuk

Files

2024-06-05_e9f5e496ba93b2dca750c40ab35117e4_ryuk
.exe windows:5 windows x64 arch:x64

dcafe14a58711d4d7e1bdcda9dec8bd1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\m6\main\maxthon\src\out\release_x64\setup.exe.pdb

Imports

gdiplus

GdipCreateFont
GdipCreateFontFamilyFromName
GdipCreateFromHDC
GdipCreateLineBrushI
GdipCreateStringFormat
GdipDeleteBrush
GdipDeleteFont
GdipDeleteFontFamily
GdipDeleteGraphics
GdipDeleteStringFormat
GdipDrawString
GdipSetStringFormatAlign
GdipSetTextRenderingHint
GdiplusStartup

advapi32

AdjustTokenPrivileges
BuildExplicitAccessWithNameW
BuildSecurityDescriptorW
BuildTrusteeWithSidW
ChangeServiceConfigW
CloseServiceHandle
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
CreateProcessAsUserW
CreateServiceW
CreateWellKnownSid
DeleteService
DuplicateToken
EventRegister
EventUnregister
EventWrite
GetLengthSid
GetNamedSecurityInfoW
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
GetUserNameW
ImpersonateNamedPipeClient
InitializeAcl
InitializeSecurityDescriptor
InitializeSid
IsTextUnicode
IsValidSid
LookupPrivilegeValueW
OpenProcessToken
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyExW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueA
RegEnumValueW
RegLoadKeyW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExA
RegQueryValueExW
RegSetValueExW
RegUnLoadKeyW
RegisterTraceGuidsW
RevertToSelf
SetEntriesInAclW
SetNamedSecurityInfoW
SetSecurityDescriptorDacl
SetSecurityInfo
SystemFunction036
TraceEvent
UnregisterTraceGuids

comdlg32

GetOpenFileNameW
GetSaveFileNameW

dbghelp

SymCleanup
SymFromAddr
SymGetLineFromAddr64
SymGetSearchPathW
SymInitialize
SymSetOptions
SymSetSearchPathW

gdi32

AddFontMemResourceEx
BitBlt
CombineRgn
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
CreateFontA
CreateFontW
CreateHatchBrush
CreatePatternBrush
CreatePen
CreateRectRgn
CreateRectRgnIndirect
CreateRoundRectRgn
CreateSolidBrush
DPtoLP
DeleteDC
DeleteObject
EnumFontFamiliesExA
ExcludeClipRect
GdiFlush
GetClipBox
GetCurrentObject
GetDIBits
GetDeviceCaps
GetMapMode
GetObjectW
GetPixel
GetStockObject
GetTextAlign
GetTextExtentExPointW
GetTextExtentPoint32A
GetTextExtentPoint32W
GetTextMetricsW
GetViewportExtEx
GetWindowExtEx
GetWindowOrgEx
IntersectClipRect
LPtoDP
PatBlt
PtInRegion
RectVisible
Rectangle
RestoreDC
SaveDC
SelectObject
SetBkColor
SetBkMode
SetBrushOrgEx
SetLayout
SetMapMode
SetPixel
SetStretchBltMode
SetTextAlign
SetTextColor
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
StretchBlt
StretchDIBits
TextOutA
TextOutW

shell32

CommandLineToArgvW
ord190
ord155
ord680
ord171
SHAppBarMessage
SHBrowseForFolderW
SHChangeNotify
SHGetFileInfoW
SHGetFolderPathW
SHGetKnownFolderPath
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHOpenWithDialog
SHQueryUserNotificationState
ShellExecuteExW
ShellExecuteW

shlwapi

ord437
PathAddBackslashW
PathAppendW
PathCreateFromUrlW
PathFileExistsW
PathFindFileNameW
PathIsDirectoryW
PathMatchSpecW
PathRemoveBackslashW
PathRemoveFileSpecW
StrStrIW
StrToIntW
UrlCanonicalizeW

user32

AdjustWindowRectEx
AllowSetForegroundWindow
BeginDeferWindowPos
BeginPaint
CallNextHookEx
CallWindowProcW
CharUpperW
ClientToScreen
CloseClipboard
CountClipboardFormats
CreateCaret
CreateCursor
CreateIconFromResourceEx
CreateWindowExA
CreateWindowExW
DefWindowProcW
DeferWindowPos
DestroyCaret
DestroyIcon
DestroyWindow
DispatchMessageW
DrawEdge
DrawFrameControl
DrawIconEx
DrawTextA
DrawTextW
EmptyClipboard
EndDeferWindowPos
EndDialog
EndPaint
EnumClipboardFormats
EqualRect
FillRect
GetActiveWindow
GetAsyncKeyState
GetCapture
GetCaretBlinkTime
GetClassInfoExW
GetClassLongPtrW
GetClientRect
GetClipboardData
GetCursorPos
GetDC
GetDesktopWindow
GetDlgCtrlID
GetDlgItem
GetDoubleClickTime
GetFocus
GetForegroundWindow
GetIconInfo
GetKeyState
GetKeyboardLayout
GetMessageW
GetMonitorInfoW
GetParent
GetScrollInfo
GetSysColor
GetSysColorBrush
GetSystemMetrics
GetWindow
GetWindowDC
GetWindowLongPtrW
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowRgn
GetWindowTextW
GetWindowThreadProcessId
InflateRect
IntersectRect
InvalidateRect
InvertRect
IsChild
IsClipboardFormatAvailable
IsWindow
IsWindowEnabled
IsWindowUnicode
IsWindowVisible
IsZoomed
KillTimer
LoadCursorFromFileA
LoadCursorW
LoadIconW
LoadImageW
LoadStringW
MapWindowPoints
MessageBeep
MessageBoxW
MonitorFromRect
MonitorFromWindow
MoveWindow
NotifyWinEvent
OffsetRect
OpenClipboard
PeekMessageW
PostMessageW
PostQuitMessage
PtInRect
RegisterClassA
RegisterClassExA
RegisterClassExW
RegisterClassW
RegisterClipboardFormatW
RegisterWindowMessageW
ReleaseCapture
ReleaseDC
ScreenToClient
ScrollDC
ScrollWindowEx
SendMessageTimeoutW
SendMessageW
SetCapture
SetCaretPos
SetClipboardData
SetCursor
SetFocus
SetForegroundWindow
SetProcessDPIAware
SetRect
SetScrollInfo
SetTimer
SetWindowLongPtrW
SetWindowLongW
SetWindowPos
SetWindowRgn
SetWindowTextW
SetWindowsHookExW
ShowWindow
SystemParametersInfoW
TranslateMessage
UnhookWindowsHookEx
UnregisterClassW
UpdateWindow
WindowFromPoint
wsprintfW

wininet

HttpOpenRequestA
HttpQueryInfoA
HttpSendRequestA
InternetCanonicalizeUrlW
InternetCloseHandle
InternetCombineUrlA
InternetCombineUrlW
InternetConnectA
InternetErrorDlg
InternetGetLastResponseInfoA
InternetOpenA
InternetQueryOptionW
InternetReadFile
InternetSetOptionW

winmm

PlaySoundW
timeBeginPeriod
timeEndPeriod
timeGetDevCaps
timeGetTime
timeKillEvent
timeSetEvent

ws2_32

WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAGetOverlappedResult
WSAResetEvent
WSAStartup
accept
closesocket
getsockname
ioctlsocket
ntohl
recv
recvfrom
sendto
shutdown

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
AllocConsole
AssignProcessToJobObject
AttachConsole
CancelIo
CloseHandle
CompareStringW
ConnectNamedPipe
CopyFileW
CreateDirectoryW
CreateEventW
CreateFileMappingW
CreateFileW
CreateIoCompletionPort
CreateMutexW
CreateNamedPipeW
CreateProcessW
CreateSemaphoreW
CreateThread
CreateToolhelp32Snapshot
DecodePointer
DeleteCriticalSection
DeleteFileW
DeleteProcThreadAttributeList
DisconnectNamedPipe
DosDateTimeToFileTime
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExitThread
ExpandEnvironmentStringsW
FileTimeToDosDateTime
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FindResourceExW
FindResourceW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FlushInstructionCache
FlushViewOfFile
FormatMessageA
FreeConsole
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetComputerNameExW
GetConsoleDisplayMode
GetConsoleMode
GetConsoleOutputCP
GetCurrencyFormatW
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDriveTypeW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileSize
GetFileSizeEx
GetFileTime
GetFileType
GetFullPathNameW
GetGeoInfoW
GetLastError
GetLocalTime
GetLocaleInfoW
GetLogicalDriveStringsW
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetNumberFormatW
GetOEMCP
GetPriorityClass
GetPrivateProfileIntW
GetPrivateProfileStringW
GetProcAddress
GetProcessHandleCount
GetProcessHeap
GetProcessId
GetProcessIoCounters
GetProcessTimes
GetProductInfo
GetQueuedCompletionStatus
GetShortPathNameW
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDefaultLCID
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempPathA
GetTempPathW
GetThreadContext
GetThreadId
GetThreadLocale
GetThreadPreferredUILanguages
GetThreadPriority
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetUserDefaultLangID
GetUserDefaultUILanguage
GetUserGeoID
GetVersionExW
GetWindowsDirectoryW
GlobalAlloc
GlobalLock
GlobalMemoryStatusEx
GlobalUnlock
HeapAlloc
HeapDestroy
HeapFree
HeapReAlloc
HeapSetInformation
HeapSize
InitOnceExecuteOnce
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeProcThreadAttributeList
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
IsWow64Process
K32GetModuleFileNameExW
K32GetModuleInformation
K32GetPerformanceInfo
K32GetProcessImageFileNameW
K32GetProcessMemoryInfo
K32QueryWorkingSetEx
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LoadResource
LocalFileTimeToFileTime
LocalFree
LockFileEx
LockResource
MapViewOfFile
MoveFileExW
MoveFileW
MulDiv
MultiByteToWideChar
OpenFileMappingW
OpenMutexW
OpenProcess
OutputDebugStringA
OutputDebugStringW
PeekNamedPipe
PostQueuedCompletionStatus
Process32FirstW
Process32NextW
QueryDosDeviceW
QueryFullProcessImageNameW
QueryPerformanceCounter
QueryPerformanceFrequency
QueryThreadCycleTime
QueueUserAPC
RaiseException
ReadConsoleW
ReadFile
ReadProcessMemory
RegisterWaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
RemoveDirectoryW
ReplaceFileW
ResetEvent
ResumeThread
RtlCaptureContext
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableW
SetEvent
SetFileAttributesW
SetFileInformationByHandle
SetFilePointer
SetFilePointerEx
SetFileTime
SetHandleInformation
SetLastError
SetNamedPipeHandleState
SetPriorityClass
SetProcessShutdownParameters
SetStdHandle
SetThreadLocale
SetThreadPriority
SetUnhandledExceptionFilter
SizeofResource
Sleep
SleepConditionVariableSRW
SleepEx
SuspendThread
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TransactNamedPipe
TryAcquireSRWLockExclusive
TzSpecificLocalTimeToSystemTime
UnhandledExceptionFilter
UnlockFileEx
UnmapViewOfFile
UnregisterWaitEx
UpdateProcThreadAttribute
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualAllocEx
VirtualFree
VirtualProtect
VirtualQuery
VirtualQueryEx
WTSGetActiveConsoleSessionId
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WaitNamedPipeW
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
Wow64GetThreadContext
WriteConsoleW
WriteFile
WriteProcessMemory
lstrcpynW
lstrlenW

ole32

CoAllowSetForegroundWindow
CoCreateGuid
CoCreateInstance
CoInitializeEx
CoRegisterInitializeSpy
CoRevokeInitializeSpy
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
PropVariantClear

bcrypt

BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptOpenAlgorithmProvider

urlmon

CreateURLMonikerEx
FindMimeFromData

crypt32

CryptBinaryToStringW

winhttp

WinHttpAddRequestHeaders
WinHttpCloseHandle
WinHttpConnect
WinHttpCrackUrl
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryHeaders
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpWriteData

comctl32

ImageList_DrawEx
ImageList_GetIconSize
ImageList_GetImageInfo

imm32

ImmAssociateContextEx
ImmGetCompositionStringW
ImmGetContext
ImmIsIME
ImmNotifyIME
ImmReleaseContext
ImmSetCandidateWindow

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW
WTSQueryUserToken

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

propsys

InitPropVariantFromCLSID

oleaut32

SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
VariantClear
VariantInit

Exports

Exports

GetHandleVerifier

Sections

.text
Size: 6.4MB - Virtual size: 6.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 100KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 241KB - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gxfg
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.retplne
Size: 512B - Virtual size: 152B

.rodata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 385B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.voltbl
Size: 512B - Virtual size: 80B

CPADinfo
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

LZMADEC
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1016KB - Virtual size: 1015KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 604KB - Virtual size: 608KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

dcafe14a58711d4d7e1bdcda9dec8bd1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdiplus

advapi32

comdlg32

dbghelp

gdi32

shell32

shlwapi

user32

wininet

winmm

ws2_32

kernel32

ole32

bcrypt

urlmon

crypt32

winhttp

comctl32

imm32

wtsapi32

version

userenv

propsys

oleaut32

Exports

Exports

Sections

.text Size: 6.4MB - Virtual size: 6.4MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 100KB - Virtual size: 157KB

.pdata Size: 241KB - Virtual size: 240KB

.00cfg Size: 512B - Virtual size: 40B

.gxfg Size: 15KB - Virtual size: 14KB

.retplne Size: 512B - Virtual size: 152B

.rodata Size: 2KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 385B

.voltbl Size: 512B - Virtual size: 80B

CPADinfo Size: 512B - Virtual size: 56B

LZMADEC Size: 4KB - Virtual size: 4KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 1016KB - Virtual size: 1015KB

.reloc Size: 604KB - Virtual size: 608KB

.text
Size: 6.4MB - Virtual size: 6.4MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 100KB - Virtual size: 157KB

.pdata
Size: 241KB - Virtual size: 240KB

.00cfg
Size: 512B - Virtual size: 40B

.gxfg
Size: 15KB - Virtual size: 14KB

.retplne
Size: 512B - Virtual size: 152B

.rodata
Size: 2KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 385B

.voltbl
Size: 512B - Virtual size: 80B

CPADinfo
Size: 512B - Virtual size: 56B

LZMADEC
Size: 4KB - Virtual size: 4KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 1016KB - Virtual size: 1015KB

.reloc
Size: 604KB - Virtual size: 608KB