2024-06-24_b53fd26cb450f850b0362057d378137c_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-24_b53fd26cb450f850b0362057d378137c_ryuk
Size

1.4MB
MD5

b53fd26cb450f850b0362057d378137c
SHA1

3bea7b8abc5b890b247ae0d7ebe7f1825efb7019
SHA256

79a287791f67b7943cec22beae081e7a6a84b744f661276f5262e54c89a5befb
SHA512

16ffb239be84eafc2c5e812a2896d68cc081ea9a8f0667048473e528420d844bc9e9e021418fa75a26b1383ab69c09b4d862400c11a80caa91d83e7e813e92a1
SSDEEP

24576:xPQ/+tHpS0knaL2upe2Bf5ObbbNf9cfZl7KuaGavkg3NyWWBRBAUZLYPMK/:fQBI42Bf5WmH7KuaGaXnWBRBAUZLYUK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-24_b53fd26cb450f850b0362057d378137c_ryuk

Files

2024-06-24_b53fd26cb450f850b0362057d378137c_ryuk
.exe windows:6 windows x64 arch:x64

14641176f54a4c8a2b05d412c64fe1b7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Jenkins\workspace\Glitch_Package_Windows7\Temp\x64\Release\XGlitchLicense\Glitch.pdb

Imports

advapi32

GetUserNameW

user32

PostQuitMessage
PeekMessageW
DispatchMessageW
TranslateMessage
GetWindow
MessageBoxW
GetForegroundWindow
IsWindow
ShowWindow
IsWindowVisible
SendMessageTimeoutW
IsIconic
SetForegroundWindow

kernel32

ReadConsoleW
GetTimeZoneInformation
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
SetFilePointerEx
GetProcessHeap
FindFirstFileExA
FindNextFileA
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
GetConsoleCP
GetFileType
SetStdHandle
GetCommandLineA
WriteFile
GetStdHandle
GetModuleHandleExW
ExitProcess
HeapReAlloc
HeapFree
HeapAlloc
FlushFileBuffers
ReadFile
CreateDirectoryW
GetCurrentDirectoryW
GetCommandLineW
IsValidCodePage
GetSystemInfo
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesW
RemoveDirectoryW
SetFileAttributesW
GetTempPathW
CloseHandle
GetLastError
SetLastError
SetErrorMode
DeviceIoControl
GetCurrentProcessId
GetModuleFileNameW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
IsDebuggerPresent
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
GetVersionExW
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetCriticalSectionSpinCount
DeleteCriticalSection
RtlCaptureContext
DuplicateHandle
GetCurrentThread
GetModuleFileNameA
QueryPerformanceCounter
QueryPerformanceFrequency
GetProcessHeaps
GetProcessAffinityMask
SetThreadAffinityMask
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
SetEvent
ResetEvent
CreateEventW
EncodePointer
DecodePointer
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
WaitForSingleObjectEx
InitializeSListHead
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetACP
RtlPcToFileHeader
RaiseException
InterlockedPushEntrySList
RtlUnwindEx
LoadLibraryExW
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
GetDriveTypeW
GetFullPathNameW
SetEnvironmentVariableA
SetEndOfFile

winmm

timeGetTime

imagehlp

StackWalk64
SymSetOptions
SymFunctionTableAccess64
SymInitialize
SymGetSymFromAddr64
SymLoadModule64
SymGetModuleBase64

shell32

SHGetFolderPathW
SHFileOperationW

Sections

.text
Size: 413KB - Virtual size: 413KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 937KB - Virtual size: 937KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.shr
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

14641176f54a4c8a2b05d412c64fe1b7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

user32

kernel32

winmm

imagehlp

shell32

Sections

.text Size: 413KB - Virtual size: 413KB

RT_CODE Size: 2KB - Virtual size: 2KB

.rdata Size: 937KB - Virtual size: 937KB

.data Size: 9KB - Virtual size: 4.0MB

.pdata Size: 22KB - Virtual size: 21KB

.shr Size: 1024B - Virtual size: 528B

.gfids Size: 1024B - Virtual size: 612B

.tls Size: 512B - Virtual size: 9B

_RDATA Size: 6KB - Virtual size: 5KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 413KB - Virtual size: 413KB

RT_CODE
Size: 2KB - Virtual size: 2KB

.rdata
Size: 937KB - Virtual size: 937KB

.data
Size: 9KB - Virtual size: 4.0MB

.pdata
Size: 22KB - Virtual size: 21KB

.shr
Size: 1024B - Virtual size: 528B

.gfids
Size: 1024B - Virtual size: 612B

.tls
Size: 512B - Virtual size: 9B

_RDATA
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 4KB - Virtual size: 4KB