2024-06-27_0d4fa1b828fe82c54dde791abb5a6178_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-27_0d4fa1b828fe82c54dde791abb5a6178_ryuk
Size

3.1MB
MD5

0d4fa1b828fe82c54dde791abb5a6178
SHA1

3613882f75b3bf713a79a89c3f701ccd4e561975
SHA256

54bf821179f41a3248ec25430d5dd0e31e4ed274f5cfa3efc422474319efd3c5
SHA512

399476414d41e0ecf15c315c99ce88d40fef3508c6b176cc650f1e462e714864d3dbe4a2079d5cbae909b0575cb29fc6ccb89d390cb908f15a76fd6aef129338
SSDEEP

49152:nh4S/8pdi7iWhyLS+oD3/hEhuAYInR7wcnF/EGBnTn6227jpT+Mk0mcBeIPDtb:nmhiTA/Vm2Ym4PRb

Score

1^/10

Malware Config

Signatures

Files

2024-06-27_0d4fa1b828fe82c54dde791abb5a6178_ryuk
.exe windows:6 windows x64 arch:x64

5091d7b2a085a54e3340e65d52cf0f4f

Code Sign

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

16/03/2016, 00:00

Not After

16/03/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:31:38:92:3b:9b:e6:29:49:65:7f:5d
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Not Before

21/08/2017, 09:50

Not After

17/08/2020, 10:01

Subject

CN=YANDEX LLC,O=YANDEX LLC,L=Moscow,ST=Moscow,C=RU,1.2.840.113549.1.9.1=#0c12706b694079616e6465782d7465616d2e7275

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:53:63:0d:11:f2:04:c2:bb:9b:26:b3
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

17/08/2017, 10:01

Not After

17/08/2020, 10:01

Subject

CN=YANDEX LLC,O=YANDEX LLC,L=Moscow,ST=Moscow,C=RU,1.2.840.113549.1.9.1=#0c12706b694079616e6465782d7465616d2e7275

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:ed:90:18:ca:a9:27:b7:62:6c:52:6b:90:6d:93:f5:67
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:89:6d:05:25:bf:cc:fe:e5:79:83:6f:f6:27:be:dd:e6:ca:00:e6:95:0a:7f:ac:4c:64:51:84:10:fd:d7:18
Signer

Actual PE Digest

26:89:6d:05:25:bf:cc:fe:e5:79:83:6f:f6:27:be:dd:e6:ca:00:e6:95:0a:7f:ac:4c:64:51:84:10:fd:d7:18

Digest Algorithm

sha256

PE Digest Matches

true

20:9f:13:81:5a:c5:35:91:dc:7c:b3:e8:f0:0a:b0:ed:36:5c:a4:6c
Signer

Actual PE Digest

20:9f:13:81:5a:c5:35:91:dc:7c:b3:e8:f0:0a:b0:ed:36:5c:a4:6c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\BuildAgent\work\e525fc1e9f9362e1\Output\x64\Release\searchbandapp64.pdb

Imports

kernel32

HeapCompact
UnlockFile
CreateFileMappingA
LockFileEx
GetFileSize
DeleteFileA
CreateFileA
GetDiskFreeSpaceW
GetProcessHeap
FlushViewOfFile
HeapAlloc
HeapReAlloc
HeapSize
HeapFree
GetTickCount
ReleaseMutex
DecodePointer
GetCurrentThreadId
WaitForSingleObject
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
lstrcmpiW
GetModuleHandleW
FreeLibrary
GetProcAddress
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
GetFullPathNameW
HeapCreate
TryEnterCriticalSection
AreFileApisANSI
QueryPerformanceFrequency
GetVolumeNameForVolumeMountPointW
GetLogicalDriveStringsW
HeapDestroy
DeviceIoControl
WriteConsoleW
SetEnvironmentVariableA
GetCommandLineW
GetCommandLineA
GetOEMCP
LockFile
InitializeCriticalSection
GetFullPathNameA
SetLastError
UnlockFileEx
IsValidCodePage
FlushFileBuffers
SetStdHandle
GetConsoleCP
GetTimeZoneInformation
EnumSystemLocalesW
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetACP
GetStdHandle
ExitProcess
VirtualQuery
VirtualProtect
SystemTimeToTzSpecificLocalTime
FindNextFileW
FindFirstFileExW
ReadConsoleW
GetConsoleMode
GetFileType
FreeLibraryAndExitThread
ExitThread
CreateThread
RtlUnwindEx
RtlPcToFileHeader
FormatMessageA
GetStringTypeExA
LCMapStringA
GetStringTypeExW
LoadLibraryA
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsSetValue
TlsGetValue
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetStringTypeW
LoadLibraryExA
InitializeSListHead
EncodePointer
OutputDebugStringW
IsDebuggerPresent
TlsFree
TlsAlloc
GetSystemTime
CreateTimerQueueTimer
DeleteTimerQueueTimer
SetUnhandledExceptionFilter
OutputDebugStringA
QueryActCtxW
GetModuleHandleExW
CreateActCtxW
GetModuleFileNameW
InitializeCriticalSectionEx
RaiseException
DeleteCriticalSection
CloseHandle
GetLastError
FindActCtxSectionStringW
ActivateActCtx
DeactivateActCtx
CopyFileW
SleepEx
GlobalMemoryStatusEx
MapViewOfFile
WaitForSingleObjectEx
GetGeoInfoW
GetUserGeoID
FreeEnvironmentStringsW
GetEnvironmentStringsW
ExpandEnvironmentStringsW
FileTimeToSystemTime
SystemTimeToFileTime
GetSystemTimeAsFileTime
FileTimeToDosDateTime
ReadFile
ReleaseSemaphore
InterlockedPushEntrySList
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
GetSystemInfo
OpenProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetEvent
FormatMessageW
FlushInstructionCache
GetCurrentProcess
CreateEventW
CreateWaitableTimerW
SetThreadPriority
ResumeThread
TerminateThread
SetWaitableTimer
CancelWaitableTimer
Sleep
WaitForMultipleObjects
ResetEvent
CreateMutexW
CreateSemaphoreW
OpenEventW
GetVersionExW
VerSetConditionMask
VerifyVersionInfoW
WideCharToMultiByte
DeleteFileW
GetDriveTypeW
CreateFileW
LoadLibraryW
SetFilePointer
MoveFileW
WriteFile
GetCurrentProcessId
FindResourceExW
LockResource
FreeResource
LocalFree
LocalAlloc
GetUserDefaultLCID
GetFileAttributesW
FindFirstFileW
FileTimeToLocalFileTime
FindClose
GetFileAttributesExW
GetFileSizeEx
SetFilePointerEx
SetEndOfFile
GetTempFileNameW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
MulDiv
lstrcmpW
DebugBreak
Module32FirstW
Module32NextW
CreateProcessW
TerminateProcess
K32GetModuleFileNameExW
CreateDirectoryW
GetTempPathW
OpenFileMappingW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFileEx

user32

RegisterClassExW
CreateWindowExW
FindWindowExW
GetKeyState
SetCapture
IsIconic
SetWindowTextW
ReleaseCapture
RemoveMenu
DispatchMessageW
CharNextW
SendMessageW
DestroyMenu
GetDlgItem
BringWindowToTop
DefWindowProcW
GetWindowLongPtrW
SetWindowLongPtrW
CallWindowProcW
DestroyWindow
PostQuitMessage
UnregisterPowerSettingNotification
RegisterPowerSettingNotification
RegisterWindowMessageW
UpdateLayeredWindow
SetWindowPos
IsWindow
UnregisterClassW
LoadStringA
PostMessageW
GetParent
GetWindowThreadProcessId
CallNextHookEx
GetDC
ReleaseDC
MsgWaitForMultipleObjectsEx
OffsetRect
GetSysColor
GetClientRect
GetWindow
SetFocus
GetFocus
LoadCursorW
InvalidateRect
FillRect
SetWindowLongW
GetWindowLongW
GetClassNameW
CreateAcceleratorTableW
ScreenToClient
ClientToScreen
InvalidateRgn
GetDesktopWindow
GetWindowDC
SetWindowsHookExW
UnhookWindowsHookEx
GetMonitorInfoW
EqualRect
MonitorFromPoint
DestroyIcon
FindWindowW
MonitorFromRect
CreatePopupMenu
GetIconInfo
IsRectEmpty
LoadStringW
MoveWindow
ShowWindow
GetWindowRect
RedrawWindow
EndPaint
IsChild
GetClassInfoExW
BeginPaint
IsWindowVisible
PeekMessageW
GetMessageW
DestroyAcceleratorTable
TranslateMessage
CopyRect

gdi32

GetDeviceCaps
CreateDIBSection
CreateSolidBrush
CreateCompatibleBitmap
GetObjectW
GetStockObject
SetBkColor
ExtTextOutW
DeleteDC
DeleteObject
SelectObject
BitBlt
CreateCompatibleDC
SetLayout
GetDIBits

advapi32

RegDeleteKeyW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
RegEnumValueW
IsValidSid
GetTokenInformation
OpenProcessToken
RegOpenKeyExW
SetNamedSecurityInfoW
IsValidAcl
GetSidLengthRequired
InitializeAcl
InitializeSid
GetSidSubAuthority
AddAce
GetLengthSid
CopySid
ConvertSidToStringSidW
GetSidIdentifierAuthority
CryptDestroyKey
CryptSetKeyParam
CryptImportKey
CryptDecrypt
CryptAcquireContextW
GetSidSubAuthorityCount
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
CryptReleaseContext

ole32

CLSIDFromProgID
CoGetClassObject
CreateStreamOnHGlobal
StringFromGUID2
CoCreateGuid
CLSIDFromString
CoInitialize
OleLockRunning
OleRun
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
OleUninitialize
CoUninitialize
OleInitialize
PropVariantClear

oleaut32

GetErrorInfo
SysStringByteLen
OleCreateFontIndirect
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
VariantClear
VariantChangeType
DispGetParam
VariantCopy
VariantInit
SysAllocString
SysFreeString
SysAllocStringByteLen
SysStringLen

shlwapi

UrlCreateFromPathW
UrlIsW
PathIsDirectoryW
PathFileExistsW
PathCanonicalizeW
PathRemoveBackslashW
PathIsUNCW
PathGetDriveNumberW
SHDeleteKeyW
PathCreateFromUrlW
ord12

msimg32

AlphaBlend

wtsapi32

WTSFreeMemory
WTSUnRegisterSessionNotification
WTSRegisterSessionNotification
WTSQuerySessionInformationW

dwmapi

DwmIsCompositionEnabled
DwmGetColorizationColor

urlmon

CoInternetGetSession
ObtainUserAgentString

wintrust

WinVerifyTrust

dsound

ord3
ord11
ord9
ord8
ord12

gdiplus

GdipGetImageHeight
GdipGetImageWidth
GdipSetPixelOffsetMode
GdipFree
GdipAlloc
GdipDeleteBrush
GdipCloneBrush
GdipSetInterpolationMode
GdipSetCompositingQuality
GdipBitmapApplyEffect
GdipDrawImageRectRectI
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipCreateEffect
GdipSetEffectParameters
GdipDeleteEffect
GdipCreateBitmapFromScan0
GdipCreateSolidFill
GdipCreateFromHDC
GdipDeleteGraphics
GdipFillRectangleI
GdipDrawImageRectI
GdipDisposeImage
GdipCloneImage
GdipSaveImageToStream
GdipGetImageRawFormat
GdipBitmapUnlockBits
GdipCreateBitmapFromStream
GdipLoadImageFromStream
GdipGetImagePixelFormat
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipBitmapLockBits
GdipFillRectanglesI
GdipImageRotateFlip
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusStartup
GdiplusShutdown
GdipCreateBitmapFromHBITMAP
GdipGetDC
GdipReleaseDC
GdipSetCompositingMode
GdipSetSmoothingMode
GdipFillRegion
GdipCreateRegionRectI
GdipDeleteRegion
GdipTranslateRegionI
GdipGetImageGraphicsContext

imagehlp

ImageGetCertificateData
ImageEnumerateCertificates

userenv

UnloadUserProfile

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

wininet

InternetCombineUrlW
InternetSetStatusCallbackW
InternetOpenW
InternetConnectW
HttpOpenRequestW
InternetSetOptionW
HttpAddRequestHeadersW
HttpSendRequestW
HttpQueryInfoW
InternetReadFile
InternetCloseHandle

secur32

GetUserNameExW

ws2_32

WSACleanup
WSAStartup

shell32

SHBindToParent
ord190
ShellExecuteExW
SHCreateItemFromIDList
SHGetIDListFromObject
SHGetFileInfoW
SHGetDesktopFolder
SHGetItemFromObject
SHParseDisplayName
SHCreateDirectoryExW
SHGetFolderPathW
ord155
SHGetKnownFolderPath
SHFileOperationW
SHAppBarMessage
CommandLineToArgvW
SHCreateItemFromParsingName

propsys

PropVariantToBSTR

crypt32

CryptMsgUpdate
CertCloseStore
CertGetNameStringW
CertGetSubjectCertificateFromStore
CertOpenStore
CryptMsgOpenToDecode
CryptMsgClose
CryptMsgGetParam

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 673KB - Virtual size: 672KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 84KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 1024B - Virtual size: 740B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 302KB - Virtual size: 301KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5091d7b2a085a54e3340e65d52cf0f4f

Code Sign

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51Certificate

Extended Key Usages

Key Usages

65:31:38:92:3b:9b:e6:29:49:65:7f:5dCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

3d:53:63:0d:11:f2:04:c2:bb:9b:26:b3Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

11:21:ed:90:18:ca:a9:27:b7:62:6c:52:6b:90:6d:93:f5:67Certificate

Extended Key Usages

Key Usages

26:89:6d:05:25:bf:cc:fe:e5:79:83:6f:f6:27:be:dd:e6:ca:00:e6:95:0a:7f:ac:4c:64:51:84:10:fd:d7:18Signer

20:9f:13:81:5a:c5:35:91:dc:7c:b3:e8:f0:0a:b0:ed:36:5c:a4:6cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

shlwapi

msimg32

wtsapi32

dwmapi

urlmon

wintrust

dsound

gdiplus

imagehlp

userenv

version

wininet

secur32

ws2_32

shell32

propsys

crypt32

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 673KB - Virtual size: 672KB

.data Size: 84KB - Virtual size: 98KB

.pdata Size: 83KB - Virtual size: 82KB

.gfids Size: 1024B - Virtual size: 740B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 302KB - Virtual size: 301KB

.reloc Size: 15KB - Virtual size: 15KB

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
Certificate

65:31:38:92:3b:9b:e6:29:49:65:7f:5d
Certificate

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

3d:53:63:0d:11:f2:04:c2:bb:9b:26:b3
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

11:21:ed:90:18:ca:a9:27:b7:62:6c:52:6b:90:6d:93:f5:67
Certificate

26:89:6d:05:25:bf:cc:fe:e5:79:83:6f:f6:27:be:dd:e6:ca:00:e6:95:0a:7f:ac:4c:64:51:84:10:fd:d7:18
Signer

20:9f:13:81:5a:c5:35:91:dc:7c:b3:e8:f0:0a:b0:ed:36:5c:a4:6c
Signer

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 673KB - Virtual size: 672KB

.data
Size: 84KB - Virtual size: 98KB

.pdata
Size: 83KB - Virtual size: 82KB

.gfids
Size: 1024B - Virtual size: 740B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 302KB - Virtual size: 301KB

.reloc
Size: 15KB - Virtual size: 15KB