2024-06-16_281055a575442d6d7995b8f19500606b_megazord_ryuk

Sharing

Copy URL

Twitter E-mail

General

Target

2024-06-16_281055a575442d6d7995b8f19500606b_megazord_ryuk
Size

21.9MB
MD5

281055a575442d6d7995b8f19500606b
SHA1

ab46fbdf95856ae176b369db4be8ff3dca29c0ac
SHA256

b2c0be475bb4df7e359b529b32c76b5684b483954fec0798028ec535d0f4f4ab
SHA512

21cf16f6a6ea9bbf16d2cd75e58517a21fedca95f006e3eec046ef6b62baf47d2ac6a30cdf4df715f2f074dfc43933454117ea5d5656eeaa23a946a3a7b0816c
SSDEEP

196608:2Ey+QzlyFB5zui9700fw8o9qz+/Sjg+J3iH9g:2mQByFBkXIo9qz+Sc+J3iH9g

Score

1^/10

Malware Config

Signatures

Files

2024-06-16_281055a575442d6d7995b8f19500606b_megazord_ryuk
.exe windows:6 windows x64 arch:x64

1d7b92f034ba5bb04c58e78ee9994e24

Code Sign

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

40:ff:d3:74:43:68:55:41:49:22:99:bb
Certificate

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

18/05/2023, 09:05

Not After

18/05/2024, 09:05

Subject

CN=北京长亭未来科技有限公司,OU=产品研发中心-产品部,O=北京长亭未来科技有限公司,L=北京,ST=北京,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

40:8b:f9:0c:c8:a5:6c:03:f1:f8:21:d7:5e:7d:4f:ab:ba:f6:9e:ce:eb:27:f6:3f:d5:fb:78:49:7a:7e:38:34
Signer

Actual PE Digest

40:8b:f9:0c:c8:a5:6c:03:f1:f8:21:d7:5e:7d:4f:ab:ba:f6:9e:ce:eb:27:f6:3f:d5:fb:78:49:7a:7e:38:34

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

lighter.pdb

Imports

bcryptprimitives

ProcessPrng

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
AddVectoredExceptionHandler
AssignProcessToJobObject
CancelIo
CancelIoEx
CloseHandle
CompareStringOrdinal
CompareStringW
ConnectNamedPipe
CreateDirectoryW
CreateEventW
CreateFileW
CreateIoCompletionPort
CreateJobObjectW
CreateMutexA
CreateNamedPipeW
CreatePipe
CreateProcessW
CreateThread
CreateWaitableTimerExW
DeleteCriticalSection
DeleteFileW
DeleteProcThreadAttributeList
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlsAlloc
FlsSetValue
FlushFileBuffers
FormatMessageA
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetComputerNameExW
GetConsoleMode
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDriveTypeW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileSizeEx
GetFileType
GetFinalPathNameByHandleW
GetFullPathNameW
GetLargePageMinimum
GetLastError
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetOverlappedResult
GetProcAddress
GetProcessHeap
GetProcessId
GetProcessIoCounters
GetProcessTimes
GetQueuedCompletionStatusEx
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemFirmwareTable
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetSystemTimePreciseAsFileTime
GetSystemTimes
GetThreadId
GetTimeZoneInformation
GetTimeZoneInformationForYear
GetUserDefaultLCID
GetWindowsDirectoryW
GlobalMemoryStatusEx
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeProcThreadAttributeList
InitializeSListHead
InitializeSRWLock
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
K32GetPerformanceInfo
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
LocalFree
MoveFileExW
MultiByteToWideChar
OpenProcess
OutputDebugStringW
PeekNamedPipe
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleA
ReadConsoleW
ReadFile
ReadFileEx
ReadProcessMemory
RegisterWaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetConsoleMode
SetConsoleTextAttribute
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableW
SetFileCompletionNotificationModes
SetFileInformationByHandle
SetFilePointerEx
SetHandleInformation
SetInformationJobObject
SetLastError
SetStdHandle
SetThreadLocale
SetThreadStackGuarantee
SetThreadUILanguage
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SleepEx
SwitchToThread
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnregisterWaitEx
UpdateProcThreadAttribute
VirtualAlloc
VirtualFree
VirtualQueryEx
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW
WriteFile
WriteFileEx
lstrlenW

ntdll

NtCancelIoFileEx
NtCreateFile
NtDeviceIoControlFile
NtGetNextThread
NtQueryInformationProcess
NtQuerySystemInformation
NtReadFile
NtWriteFile
RtlGetVersion
RtlNtStatusToDosError

advapi32

AdjustTokenPrivileges
CopySid
CryptAcquireContextW
CryptCreateHash
CryptDecrypt
CryptDestroyHash
CryptDestroyKey
CryptEnumProvidersW
CryptExportKey
CryptGetProvParam
CryptGetUserKey
CryptReleaseContext
CryptSetHashParam
CryptSignHashW
DeregisterEventSource
GetLengthSid
GetTokenInformation
IsValidSid
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegisterEventSourceW
RegisterServiceCtrlHandlerExW
ReportEventW
SetServiceStatus
StartServiceCtrlDispatcherW
SystemFunction036

bcrypt

BCryptGenRandom

powrprof

CallNtPowerInformation

crypt32

CertCloseStore
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertGetEnhancedKeyUsage
CertOpenStore
CertVerifyTimeValidity

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize

shell32

CommandLineToArgvW

user32

EnumThreadWindows
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
PostMessageW

oleaut32

GetErrorInfo
SysAllocStringLen
SysFreeString
SysStringLen
VariantClear

psapi

GetModuleFileNameExW
GetProcessMemoryInfo

pdh

PdhAddEnglishCounterW
PdhCloseQuery
PdhCollectQueryData
PdhGetFormattedCounterValue
PdhOpenQueryA
PdhRemoveCounter

ws2_32

WSACleanup
WSAGetLastError
WSAIoctl
WSASend
WSASetLastError
WSASocketW
WSAStartup
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyaddr
gethostbyname
getpeername
getservbyname
getservbyport
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
ioctlsocket
ntohs
recv
select
send
setsockopt
shutdown
socket

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressAll
WakeByAddressSingle

Sections

.text
Size: 15.1MB - Virtual size: 15.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.8MB - Virtual size: 5.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 51KB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 724KB - Virtual size: 724KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 825B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.voltbl
Size: 1024B - Virtual size: 988B

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1d7b92f034ba5bb04c58e78ee9994e24

Code Sign

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47Certificate

Extended Key Usages

Key Usages

40:ff:d3:74:43:68:55:41:49:22:99:bbCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

40:8b:f9:0c:c8:a5:6c:03:f1:f8:21:d7:5e:7d:4f:ab:ba:f6:9e:ce:eb:27:f6:3f:d5:fb:78:49:7a:7e:38:34Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

kernel32

ntdll

advapi32

bcrypt

powrprof

crypt32

ole32

shell32

user32

oleaut32

psapi

pdh

ws2_32

api-ms-win-core-synch-l1-2-0

Sections

.text Size: 15.1MB - Virtual size: 15.1MB

.rdata Size: 5.8MB - Virtual size: 5.8MB

.data Size: 51KB - Virtual size: 1.6MB

.pdata Size: 724KB - Virtual size: 724KB

.00cfg Size: 512B - Virtual size: 40B

.tls Size: 1024B - Virtual size: 825B

.voltbl Size: 1024B - Virtual size: 988B

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 139KB - Virtual size: 139KB

.reloc Size: 134KB - Virtual size: 134KB

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

40:ff:d3:74:43:68:55:41:49:22:99:bb
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

40:8b:f9:0c:c8:a5:6c:03:f1:f8:21:d7:5e:7d:4f:ab:ba:f6:9e:ce:eb:27:f6:3f:d5:fb:78:49:7a:7e:38:34
Signer

.text
Size: 15.1MB - Virtual size: 15.1MB

.rdata
Size: 5.8MB - Virtual size: 5.8MB

.data
Size: 51KB - Virtual size: 1.6MB

.pdata
Size: 724KB - Virtual size: 724KB

.00cfg
Size: 512B - Virtual size: 40B

.tls
Size: 1024B - Virtual size: 825B

.voltbl
Size: 1024B - Virtual size: 988B

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 139KB - Virtual size: 139KB

.reloc
Size: 134KB - Virtual size: 134KB