2024-06-25_17ac0da928a4a517ffe0f57d206d5ec2_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-25_17ac0da928a4a517ffe0f57d206d5ec2_ryuk
Size

492KB
MD5

17ac0da928a4a517ffe0f57d206d5ec2
SHA1

5ecca3b1fbb0486c3c8b1575a87c66e66e5e0ede
SHA256

3e6ff3746b1149b9864f8d0e35a7e5f383a9acacb3b457ba8d32f9c6d6b5710d
SHA512

b5d4f76a41b6dc685daddb3d9e868d18caf7f0a50b307a006e7f82bf62bb9631783efb306fc44d37a2523f35f9df01e88374cc0866b706280d81ee116b9f4af6
SSDEEP

12288:wjaaF2sTh5S3B8tlNfYKF/DCeT2T8fltAP:3aF2eh5S3B8PNfhZT2T8flOP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-25_17ac0da928a4a517ffe0f57d206d5ec2_ryuk

Files

2024-06-25_17ac0da928a4a517ffe0f57d206d5ec2_ryuk
.exe windows:10 windows x64 arch:x64

606a690081d1bdedf2f5dc3cb5f1d4a4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

MpSigStub.pdb

Imports

advapi32

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
RegCloseKey
OpenSCManagerW
OpenServiceW
StartServiceW
QueryServiceStatus
CloseServiceHandle
CheckTokenMembership
RegNotifyChangeKeyValue
SetSecurityDescriptorDacl
AllocateAndInitializeSid
RegCreateKeyExW
CopySid
IsValidSid
RegSetValueExW
OpenProcessToken
FreeSid
InitializeSecurityDescriptor
InitializeAcl
GetTokenInformation
RegQueryValueExW
AddAccessAllowedAce
GetLengthSid
RegDeleteValueW
RegOpenKeyExW

kernel32

ReadConsoleW
DecodePointer
LoadLibraryExW
SetWaitableTimer
CreateWaitableTimerW
CopyFileW
DeleteFileW
RemoveDirectoryW
MoveFileExW
GetTimeFormatW
GetDateFormatW
OutputDebugStringW
IsDebuggerPresent
EnterCriticalSection
CloseHandle
LeaveCriticalSection
GetCommandLineW
SetFileAttributesW
HeapFree
GetProcessHeap
HeapAlloc
GetCurrentProcess
GetLastError
Process32NextW
GetCurrentProcessId
Process32FirstW
CreateToolhelp32Snapshot
FreeLibrary
SetEndOfFile
FormatMessageW
WideCharToMultiByte
RaiseException
MultiByteToWideChar
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
TerminateProcess
GetModuleFileNameW
GetProcAddress
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetACP
SetLastError
GetStringTypeW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
DeleteCriticalSection
SetStdHandle
GetFileType
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LCMapStringW
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
CreateFileW
EncodePointer
CreateDirectoryW
SizeofResource
WaitForSingleObject
GetSystemDirectoryW
Sleep
LockResource
LoadResource
FindResourceW
GetCurrentDirectoryW
CreateProcessW
GetSystemWindowsDirectoryW
ReadFile
FindFirstFileW
GetFileSizeEx
GetFullPathNameW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
GetTempPathW
GetFileAttributesW
OpenProcess
CreateEventW
SetEvent
HeapSetInformation
LocalFree
GetTickCount
GetLocalTime
VirtualLock
WaitForMultipleObjects

ole32

CoCreateGuid

rpcrt4

UuidCreate

ntdll

RtlPcToFileHeader
RtlGetVersion
RtlLookupFunctionEntry
RtlCaptureContext
RtlNtStatusToDosError
RtlVirtualUnwind
RtlUnwindEx

Sections

.text
Size: 305KB - Virtual size: 304KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

606a690081d1bdedf2f5dc3cb5f1d4a4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

ole32

rpcrt4

ntdll

Sections

.text Size: 305KB - Virtual size: 304KB

.rdata Size: 144KB - Virtual size: 143KB

.data Size: 6KB - Virtual size: 11KB

.pdata Size: 15KB - Virtual size: 15KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 305KB - Virtual size: 304KB

.rdata
Size: 144KB - Virtual size: 143KB

.data
Size: 6KB - Virtual size: 11KB

.pdata
Size: 15KB - Virtual size: 15KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 3KB - Virtual size: 2KB