2024-06-28_c0625e18ccd8a66a96f59b3625fe0357_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-28_c0625e18ccd8a66a96f59b3625fe0357_ryuk
Size

624KB
MD5

c0625e18ccd8a66a96f59b3625fe0357
SHA1

c67adb9d320fe7cc1c02e90843980a5ec5330500
SHA256

e7c927275858081031f3906f96270b479209887c520adb1e495f0a7c3b3b6107
SHA512

805ed0936fd1689e126c85f16a9a6e55780eebb9177ee5f5eb46f1de0383daa7fa5c6e17f6128dfb4460617cd2e06dc9745a64ef5c166fb40708896175917907
SSDEEP

12288:VnZIU3mNarNq6eBMvwtLbkuoLkwQk7AZ:VnWU3caZq63vwtLbku6kwNkZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-28_c0625e18ccd8a66a96f59b3625fe0357_ryuk

Files

2024-06-28_c0625e18ccd8a66a96f59b3625fe0357_ryuk
.exe windows:5 windows x64 arch:x64

a2aeea5a846e48aa980d6e7af8537eb2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\X\LuckyClover\bin\clover\x64\Clover.pdb

Imports

ws2_32

WSACleanup
__WSAFDIsSet
closesocket
select
shutdown
WSASocketW
getaddrinfo
WSAStartup
getpeername
getsockname
send
socket
ntohs
connect
recv
getsockopt
freeaddrinfo
ioctlsocket
getnameinfo
setsockopt
WSAGetLastError

kernel32

SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
GetFileAttributesExW
HeapFree
InitializeCriticalSectionAndSpinCount
HeapSize
GetLastError
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
GetProcessHeap
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA
SizeofResource
Sleep
LockResource
FindResourceExW
WriteConsoleW
FindResourceW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
CloseHandle
DuplicateHandle
WaitForSingleObjectEx
GetCurrentProcess
GetCurrentThread
MultiByteToWideChar
EncodePointer
QueryPerformanceCounter
SetLastError
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
IsDebuggerPresent
OutputDebugStringW
CreateProcessA
GetExitCodeProcess
ReadConsoleW
CreateFileW
SetEndOfFile
LoadResource
RtlLookupFunctionEntry
SetFilePointerEx
ReadFile
SetEvent
ResetEvent
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
WaitForSingleObject
RtlPcToFileHeader
RtlUnwindEx
GetModuleHandleExW
ExitProcess
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetACP
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW

advapi32

RegQueryValueExA
RegOpenKeyExA
RegConnectRegistryA
RegCloseKey

shlwapi

PathFileExistsA

Sections

.text
Size: 415KB - Virtual size: 414KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 158KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a2aeea5a846e48aa980d6e7af8537eb2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

advapi32

shlwapi

Sections

.text Size: 415KB - Virtual size: 414KB

.rdata Size: 158KB - Virtual size: 158KB

.data Size: 14KB - Virtual size: 22KB

.pdata Size: 25KB - Virtual size: 24KB

.gfids Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1024B - Virtual size: 648B

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 415KB - Virtual size: 414KB

.rdata
Size: 158KB - Virtual size: 158KB

.data
Size: 14KB - Virtual size: 22KB

.pdata
Size: 25KB - Virtual size: 24KB

.gfids
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1024B - Virtual size: 648B

.reloc
Size: 5KB - Virtual size: 5KB