2024-06-12_e293793f0f7907243d41005a9a2da44e_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-12_e293793f0f7907243d41005a9a2da44e_ryuk
Size 1.6MB
Sample240612-scea5ashrl
SHA256 1e4e462866ecdf94153d2a9649d627dd5e62e76f8fcd20a58834aeb395474dfd
MD5 e293793f0f7907243d41005a9a2da44e
SHA1 ebf4b4ddf0315b20297d627cc2b0470b72fb3494
SHA512 69347dcc92faa56f230da72fa18c317f85eeece6b78c92398ede6c30a90c157517f2a9ae66c3ce47d02268d2aa49f0887003fdd39c2c3a766eb035115d9b2e03
SSDEEP 24576:Z5nac2LUCjmSvc/HeecU9OrgaS4lgogtFfJ2jfS1eI/V2fjxJoPJjg0XUx+T:0TjoBclKTJ2DQS9JyJjg0XUgT
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-06-12_e293793f0f7907243d41005a9a2da44e_ryuk

.exe 1.6MB

2024-06-12_e293793f0f7907243d41005a9a2da44e_ryuk

IMPHASH 799c1af5196dac2b0f1bc4c4cbec0c63
SHA256 1e4e462866ecdf94153d2a9649d627dd5e62e76f8fcd20a58834aeb395474dfd
MD5 e293793f0f7907243d41005a9a2da44e
SHA1 ebf4b4ddf0315b20297d627cc2b0470b72fb3494
SHA512 69347dcc92faa56f230da72fa18c317f85eeece6b78c92398ede6c30a90c157517f2a9ae66c3ce47d02268d2aa49f0887003fdd39c2c3a766eb035115d9b2e03
SSDEEP 24576:Z5nac2LUCjmSvc/HeecU9OrgaS4lgogtFfJ2jfS1eI/V2fjxJoPJjg0XUx+T:0TjoBclKTJ2DQS9JyJjg0XUgT
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

101548

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetSystemTimeAsFileTime DeleteFileW WriteConsoleW SetEnvironmentVariableA HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap WideCharToMultiByte SizeofResource LockResource LoadResource FindResourceW FindResourceExW GetProcAddress GetModuleHandleA CompareStringW QueryPerformanceCounter GetLastError ReadFile WriteFile MultiByteToWideChar InitializeCriticalSectionAndSpinCount LoadLibraryA RaiseException DecodePointer DeleteCriticalSection FreeLibrary FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent CloseHandle SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW GetStartupInfoW GetCurrentProcessId GetCurrentThreadId GetTimeZoneInformation InitializeSListHead EncodePointer SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree LCMapStringW GetStringTypeW GetCPInfo RtlPcToFileHeader LoadLibraryExW RtlUnwindEx CreateFileW GetFileType GetModuleHandleExW GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetFilePointerEx ExitProcess GetModuleFileNameA GetStdHandle GetCommandLineA GetCommandLineW GetACP GetConsoleMode ReadConsoleW GetConsoleCP FlushFileBuffers GetDateFormatW GetTimeFormatW SetStdHandle SetEndOfFile GetFileAttributesExW GetCurrentDirectoryW GetFullPathNameW FindClose

Name

.text

Size

896KB

Virtual Size

896KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

142KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

33KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

284B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

498KB

Virtual Size

497KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2024-06-12_e293793f0f7907243d41005a9a2da44e_ryuk

PE Signature issue

kernel32

generic