2024-06-14_eabbc48aec8fb9b30efb676c4656ac96_gazer_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-14_eabbc48aec8fb9b30efb676c4656ac96_gazer_ryuk
Size

5.3MB
MD5

eabbc48aec8fb9b30efb676c4656ac96
SHA1

59c610df981868603ee15bea16bf75962a89301c
SHA256

373e436b54a50bd45e44df34f7be6d09c4ea37c15233569c5b40620acef2699d
SHA512

909edacee2e02fb2dc1ad5a50c021ff96b24c2533cd48431fc5615f10ea55ae43eba621323b4d27cbde62fa8639165c963df1713f2b791b486c262ac9a0d3a16
SSDEEP

49152:0x2VxjDremeQwIIhUsFTsK6pAIC+OOEz8jkYf2kyU0dxmKj6sMSg6TMgRwp4+M8K:VfjDtuGpXCfOE453WxPjtdR09

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-14_eabbc48aec8fb9b30efb676c4656ac96_gazer_ryuk

Files

2024-06-14_eabbc48aec8fb9b30efb676c4656ac96_gazer_ryuk
.exe windows:6 windows x64 arch:x64

ca682b1d2bdd996bc1e6b8ceeaf800e4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

/tmp/job13433491125104820797/build/dmengine.pdb

Imports

openal32

alBufferData
alDeleteBuffers
alDeleteSources
alGenBuffers
alGenSources
alGetError
alGetSourcei
alGetString
alSourcePlay
alSourceQueueBuffers
alSourceStop
alSourceUnqueueBuffers
alcCloseDevice
alcCreateContext
alcDestroyContext
alcGetCurrentContext
alcMakeContextCurrent
alcOpenDevice

steam_api64

SteamAPI_GetHSteamPipe
SteamAPI_GetHSteamUser
SteamAPI_Init
SteamAPI_IsSteamRunning
SteamAPI_RegisterCallResult
SteamAPI_RegisterCallback
SteamAPI_RestartAppIfNecessary
SteamAPI_RunCallbacks
SteamAPI_Shutdown
SteamAPI_UnregisterCallResult
SteamAPI_UnregisterCallback
SteamInternal_ContextInit
SteamInternal_CreateInterface

dbghelp

MiniDumpWriteDump
SymCleanup
SymFromAddr
SymGetLineFromAddr64
SymInitialize
SymSetOptions

user32

AdjustWindowRect
AdjustWindowRectEx
BringWindowToTop
CallNextHookEx
CallWindowProcA
ChangeDisplaySettingsA
CharUpperA
CharUpperW
ClientToScreen
ClipCursor
CreateWindowExA
DefWindowProcA
DestroyWindow
DispatchMessageA
EnumDisplayDevicesA
EnumDisplayMonitors
EnumDisplaySettingsA
EnumDisplaySettingsExA
GetAsyncKeyState
GetClientRect
GetClipCursor
GetCursorPos
GetDC
GetForegroundWindow
GetKeyState
GetKeyboardState
GetMessageTime
GetMonitorInfoA
GetWindowLongPtrA
GetWindowPlacement
GetWindowRect
IsWindowVisible
IsZoomed
LoadCursorA
LoadCursorFromFileA
LoadIconA
LoadImageA
MapVirtualKeyA
MonitorFromWindow
PeekMessageA
PostMessageA
PostQuitMessage
RegisterClassA
ReleaseCapture
ReleaseDC
ScreenToClient
SendMessageA
SetCapture
SetCursor
SetCursorPos
SetFocus
SetForegroundWindow
SetWindowLongPtrA
SetWindowPlacement
SetWindowPos
SetWindowTextA
SetWindowTextW
SetWindowsHookExA
ShowCursor
ShowWindow
SystemParametersInfoA
ToAscii
ToUnicode
TrackMouseEvent
UnhookWindowsHookEx
UnregisterClassA
WaitMessage

shell32

CommandLineToArgvW
SHGetFolderPathA
ShellExecuteA

ws2_32

WSACleanup
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyaddr
gethostbyname
gethostname
getnameinfo
getpeername
getservbyport
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
inet_ntop
inet_pton
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket

opengl32

glBindTexture
glBlendFunc
glClear
glClearColor
glClearDepth
glClearStencil
glColorMask
glCullFace
glDeleteTextures
glDepthFunc
glDepthMask
glDisable
glDrawArrays
glDrawBuffer
glDrawElements
glEnable
glFlush
glGenTextures
glGetError
glGetFloatv
glGetIntegerv
glGetString
glPixelStorei
glPolygonOffset
glReadBuffer
glReadPixels
glScissor
glStencilFunc
glStencilMask
glStencilOp
glTexImage2D
glTexParameteri
glTexSubImage2D
glViewport
wglCreateContext
wglDeleteContext
wglGetProcAddress
wglMakeCurrent
wglShareLists

psapi

EnumProcessModules
GetModuleFileNameExA
GetModuleInformation

kernel32

CloseHandle
CompareStringW
CreateDirectoryW
CreateEventW
CreateFileA
CreateFileW
CreatePipe
CreateProcessW
CreateSemaphoreW
CreateThread
DecodePointer
DeleteCriticalSection
DeleteFileW
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExitThread
ExpandEnvironmentStringsA
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
FormatMessageA
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleCP
GetConsoleMode
GetConsoleWindow
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDriveTypeW
GetEnvironmentStringsW
GetExitCodeProcess
GetFileAttributesExW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetLocaleInfoW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemTimeAsFileTime
GetTempPathW
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetVersionExA
GetWindowsDirectoryA
HeapAlloc
HeapFree
HeapQueryInformation
HeapReAlloc
HeapSize
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
InterlockedFlushSList
InterlockedPushEntrySList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalFree
MoveFileExA
MoveFileExW
MultiByteToWideChar
OutputDebugStringW
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleW
ReadFile
ReleaseSemaphore
RemoveDirectoryW
ResetEvent
ResumeThread
RtlCaptureContext
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableW
SetEvent
SetFilePointerEx
SetLastError
SetStdHandle
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableCS
SystemTimeToTzSpecificLocalTime
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WaitForSingleObjectEx
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA

glu32

gluErrorString

iphlpapi

GetAdaptersAddresses

xinput9_1_0

XInputGetState

Exports

Exports

DecryptXTeaCTR
EncryptXTeaCTR
LZ4CompressBuffer
LZ4DecompressBuffer
LZ4MaxCompressedSize
Particle_CreateContext
Particle_CreateInstance
Particle_DeletePrototype
Particle_DestroyContext
Particle_DestroyInstance
Particle_GenerateVertexData
Particle_GetContextMaxParticleCount
Particle_GetEmitterCount
Particle_GetInstanceStats
Particle_GetMaterial
Particle_GetMaterialPath
Particle_GetStats
Particle_GetTileSource
Particle_GetTileSourcePath
Particle_GetVertexBufferSize
Particle_Hash
Particle_IsSleeping
Particle_NewPrototype
Particle_NewPrototypeFromDDF
Particle_ReloadInstance
Particle_ReloadPrototype
Particle_RenderEmitter
Particle_ResetInstance
Particle_ResetRenderConstant
Particle_SetContextMaxParticleCount
Particle_SetMaterial
Particle_SetPosition
Particle_SetRenderConstant
Particle_SetRotation
Particle_SetScale
Particle_SetScaleAlongZ
Particle_SetTileSource
Particle_StartInstance
Particle_StopInstance
Particle_Update
__swprintf_l
__vswprintf_l
_fprintf_l
_fprintf_p
_fprintf_p_l
_fprintf_s_l
_fscanf_l
_fscanf_s_l
_fwprintf_l
_fwprintf_p
_fwprintf_p_l
_fwprintf_s_l
_fwscanf_l
_fwscanf_s_l
_printf_l
_printf_p
_printf_p_l
_printf_s_l
_scanf_l
_scanf_s_l
_scprintf
_scprintf_l
_scprintf_p
_scprintf_p_l
_scwprintf
_scwprintf_l
_scwprintf_p
_scwprintf_p_l
_snprintf
_snprintf_c
_snprintf_c_l
_snprintf_l
_snprintf_s
_snprintf_s_l
_snscanf
_snscanf_l
_snscanf_s
_snscanf_s_l
_snwprintf
_snwprintf_l
_snwprintf_s
_snwprintf_s_l
_snwscanf
_snwscanf_l
_snwscanf_s
_snwscanf_s_l
_sprintf_l
_sprintf_p
_sprintf_p_l
_sprintf_s_l
_sscanf_l
_sscanf_s_l
_swprintf
_swprintf_c
_swprintf_c_l
_swprintf_l
_swprintf_p
_swprintf_p_l
_swprintf_s_l
_swscanf_l
_swscanf_s_l
_vfprintf_l
_vfprintf_p
_vfprintf_p_l
_vfprintf_s_l
_vfscanf_l
_vfscanf_s_l
_vfwprintf_l
_vfwprintf_p
_vfwprintf_p_l
_vfwprintf_s_l
_vfwscanf_l
_vfwscanf_s_l
_vprintf_l
_vprintf_p
_vprintf_p_l
_vprintf_s_l
_vscanf_l
_vscanf_s_l
_vscprintf
_vscprintf_l
_vscprintf_p
_vscprintf_p_l
_vscwprintf
_vscwprintf_l
_vscwprintf_p
_vscwprintf_p_l
_vsnprintf
_vsnprintf_c
_vsnprintf_c_l
_vsnprintf_l
_vsnprintf_s
_vsnprintf_s_l
_vsnwprintf
_vsnwprintf_l
_vsnwprintf_s
_vsnwprintf_s_l
_vsnwscanf_l
_vsnwscanf_s_l
_vsprintf_l
_vsprintf_p
_vsprintf_p_l
_vsprintf_s_l
_vsscanf_l
_vsscanf_s_l
_vswprintf
_vswprintf_c
_vswprintf_c_l
_vswprintf_l
_vswprintf_p
_vswprintf_p_l
_vswprintf_s_l
_vswscanf_l
_vswscanf_s_l
_vwprintf_l
_vwprintf_p
_vwprintf_p_l
_vwprintf_s_l
_vwscanf_l
_vwscanf_s_l
_wprintf_l
_wprintf_p
_wprintf_p_l
_wprintf_s_l
_wscanf_l
_wscanf_s_l
dmHashBuffer32
dmHashBuffer64
dmHashBufferNoReverse32
dmHashBufferNoReverse64
dmHashClone32
dmHashClone64
dmHashEnableReverseHash
dmHashFinal32
dmHashFinal64
dmHashInit32
dmHashInit64
dmHashRelease32
dmHashRelease64
dmHashReverse32
dmHashReverse64
dmHashReverseErase32
dmHashReverseErase64
dmHashReverseSafe64
dmHashString32
dmHashString64
dmHashUpdateBuffer32
dmHashUpdateBuffer64
fprintf
fprintf_s
fscanf
fscanf_s
fwprintf
fwprintf_s
fwscanf
fwscanf_s
printf
printf_s
scanf
scanf_s
snprintf
sprintf
sprintf_s
sscanf
sscanf_s
swprintf
swprintf_s
swscanf
swscanf_s
vfprintf
vfprintf_s
vfscanf
vfscanf_s
vfwprintf
vfwprintf_s
vfwscanf
vfwscanf_s
vprintf
vprintf_s
vscanf
vscanf_s
vsnprintf
vsnprintf_s
vsprintf
vsprintf_s
vsscanf
vsscanf_s
vswprintf
vswprintf_s
vswscanf
vswscanf_s
vwprintf
vwprintf_s
vwscanf
vwscanf_s
wprintf
wprintf_s
wscanf
wscanf_s

Sections

.text
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 850KB - Virtual size: 849KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 123KB - Virtual size: 780KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 195KB - Virtual size: 194KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 98KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ca682b1d2bdd996bc1e6b8ceeaf800e4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

openal32

steam_api64

dbghelp

user32

shell32

ws2_32

opengl32

psapi

kernel32

advapi32

glu32

iphlpapi

xinput9_1_0

Exports

Exports

Sections

.text Size: 3.9MB - Virtual size: 3.9MB

.rdata Size: 850KB - Virtual size: 849KB

.data Size: 123KB - Virtual size: 780KB

.pdata Size: 195KB - Virtual size: 194KB

.00cfg Size: 512B - Virtual size: 40B

.rodata Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

_RDATA Size: 136KB - Virtual size: 136KB

.rsrc Size: 98KB - Virtual size: 97KB

.reloc Size: 20KB - Virtual size: 19KB

.text
Size: 3.9MB - Virtual size: 3.9MB

.rdata
Size: 850KB - Virtual size: 849KB

.data
Size: 123KB - Virtual size: 780KB

.pdata
Size: 195KB - Virtual size: 194KB

.00cfg
Size: 512B - Virtual size: 40B

.rodata
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

_RDATA
Size: 136KB - Virtual size: 136KB

.rsrc
Size: 98KB - Virtual size: 97KB

.reloc
Size: 20KB - Virtual size: 19KB