2024-06-27_3b8b158a47a15d1e987d537ffdf72447_poet-rat_ryuk

Sharing

Copy URL

Twitter E-mail

General

Target

2024-06-27_3b8b158a47a15d1e987d537ffdf72447_poet-rat_ryuk
Size

3.2MB
MD5

3b8b158a47a15d1e987d537ffdf72447
SHA1

3c140a762d1c64c88d1e6b863c0403ef3e78ad36
SHA256

9b91d1563625f3dfa4f6f649c68d4b64b3c6e65d5689469f9f40e2751b22c1d4
SHA512

03d302e16d700b87ab7a486d40a9c8d955af6b7af7c7c96ada9194fbfcb2fce8a42391176f84ad0cecedc8396170fc93162e66faedf62fc0c1cd3d3446fc8242
SSDEEP

49152:SBOObDU62yUQSFbSTysQ9uGw8E5qlt96w1h3OMoG+xxniAUXZX1Tb:sLSSTyUt8r3ObniAU/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-27_3b8b158a47a15d1e987d537ffdf72447_poet-rat_ryuk

Files

2024-06-27_3b8b158a47a15d1e987d537ffdf72447_poet-rat_ryuk
.exe windows:6 windows x64 arch:x64

6682f67728d86ddfa3bbe438e1bc318a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvfw32

ICDecompress
ICSendMessage
ICClose
ICOpen

avifil32

AVIFileGetStream
AVIStreamInfoA
AVIStreamGetFrameClose
AVIStreamRelease
AVIStreamGetFrame
AVIFileOpenA
AVIFileRelease
AVIFileInit
AVIStreamGetFrameOpen

avicap32

capCreateCaptureWindowA
capGetDriverDescriptionA

kernel32

GetModuleHandleA
GetProcAddress
LoadLibraryA
GetTickCount
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
GetSystemTimeAsFileTime
CreateMutexW
ReleaseMutex
CreateEventW
SleepEx
CancelIo
GetCurrentProcess
WaitForMultipleObjects
DuplicateHandle
VerifyVersionInfoA
ReleaseSemaphore
WriteFile
DeviceIoControl
CreateFileA
GetVersionExA
GetOverlappedResult
VerSetConditionMask
GetCurrentProcessId
FreeLibrary
CreateSemaphoreA
SetThreadAffinityMask
GetProcessAffinityMask
TerminateThread
FormatMessageA
GetTempFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
GetTimeZoneInformation
GetProcessHeap
SetEndOfFile
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
ReadConsoleW
GetConsoleMode
GetConsoleCP
GetACP
GetCommandLineW
GetCommandLineA
ExitProcess
HeapReAlloc
HeapFree
HeapAlloc
WriteConsoleW
GetModuleFileNameA
GetStdHandle
SetFilePointerEx
GetModuleHandleExW
ResumeThread
ExitThread
GetTempPathA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
DeleteCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
DeleteFileA
CreateNamedPipeA
DisconnectNamedPipe
ConnectNamedPipe
GetLastError
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetDriveTypeW
CreateFileW
RtlUnwindEx
RtlPcToFileHeader
CloseHandle
ReadFile
GetCurrentThreadId
Sleep
RaiseException
HeapSize
GetTempPathW
DeleteFileW
SetEnvironmentVariableA
WideCharToMultiByte
WaitForSingleObjectEx
GetCurrentThread
GetExitCodeThread
MultiByteToWideChar
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
OutputDebugStringW
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RegisterWaitForSingleObject
LoadLibraryW
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
UnregisterWait
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect

user32

SetCapture
DestroyWindow
IsWindow
GetMonitorInfoA
MonitorFromRect
LoadIconA
LoadCursorA
GetClassLongPtrA
SetWindowLongPtrA
GetWindowLongPtrA
OffsetRect
SubtractRect
ScreenToClient
SetCursor
GetWindowRect
GetClientRect
GetWindowTextA
InvalidateRect
GetMessageA
BeginPaint
ReleaseDC
GetDC
ReleaseCapture
EndPaint
GetKeyState
SetFocus
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
SetWindowPos
MoveWindow
ShowWindow
CreateWindowExA
UnregisterClassA
RegisterClassA
DefWindowProcA
SendMessageA
PeekMessageA
DispatchMessageA
TranslateMessage

gdi32

GdiFlush
GetObjectA
SetDIBColorTable
SetStretchBltMode
StretchBlt
SelectObject
GetStockObject
GetCurrentObject
FillRgn
DeleteObject
DeleteDC
CreateRectRgn
CreateCompatibleDC
CreateCompatibleBitmap
CombineRgn
BitBlt
CreateDIBSection

ole32

CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitialize

oleaut32

VariantInit
VariantClear
OleCreatePropertyFrame

comdlg32

GetSaveFileNameA

advapi32

RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegCloseKey

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 982KB - Virtual size: 982KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 719KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6682f67728d86ddfa3bbe438e1bc318a

Headers

DLL Characteristics

File Characteristics

Imports

msvfw32

avifil32

avicap32

kernel32

user32

gdi32

ole32

oleaut32

comdlg32

advapi32

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.rdata Size: 982KB - Virtual size: 982KB

.data Size: 60KB - Virtual size: 719KB

.pdata Size: 96KB - Virtual size: 95KB

.gfids Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 17KB - Virtual size: 16KB

.text
Size: 2.1MB - Virtual size: 2.1MB

.rdata
Size: 982KB - Virtual size: 982KB

.data
Size: 60KB - Virtual size: 719KB

.pdata
Size: 96KB - Virtual size: 95KB

.gfids
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 17KB - Virtual size: 16KB