Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-06_0061d40d76d3562b84a7d16f8ba8e7bd_poet-rat_ryuk.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-07-06_0061d40d76d3562b84a7d16f8ba8e7bd_poet-rat_ryuk.exe
Resource
win10v2004-20240704-en
Target
2024-07-06_0061d40d76d3562b84a7d16f8ba8e7bd_poet-rat_ryuk
Size
24.3MB
MD5
0061d40d76d3562b84a7d16f8ba8e7bd
SHA1
859bfc20455056e6afa307aae5594ddd776654dd
SHA256
f212b9b706489986fb238e7cb3a92a264b7fc13cad7ec333b88010313804361e
SHA512
02a82774ecaed96257799dbf5bd7db2c67a54223f36b691177885e9c670651eb7ca48ccc6eb69f672c0db7986b1b14fa5b055d3d3ca4815961b474ba1fa8c93e
SSDEEP
196608:A3f+EaPlU5bImWhT/nu1BFipAOMfPe7ChbmlX:wm2dPsjGBbrCfB
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
CoCreateInstance
CoInitializeEx
CoUninitialize
SysAllocString
SysAllocStringLen
SysFreeString
VarR8FromDec
BitBlt
CreateCompatibleDC
CreateDIBSection
DeleteDC
DeleteObject
GetDeviceCaps
SelectObject
ClientToScreen
EnumDisplayMonitors
EnumWindows
GetClientRect
GetCursorPos
GetDC
GetForegroundWindow
GetSystemMetrics
GetWindowLongPtrA
GetWindowRect
GetWindowTextA
GetWindowThreadProcessId
IsWindow
MapVirtualKeyA
MessageBoxA
PostMessageA
ReleaseDC
SendInput
SetForegroundWindow
SetWindowPos
ShowWindow
VkKeyScanA
AcquireSRWLockExclusive
AddVectoredExceptionHandler
AreFileApisANSI
CloseHandle
CreateEventA
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateIoCompletionPort
CreateMutexW
CreateThread
CreateWaitableTimerA
CreateWaitableTimerExW
DeleteCriticalSection
DeleteFileA
DeleteFileW
DuplicateHandle
EnterCriticalSection
ExitProcess
FlsAlloc
FlsGetValue
FlsSetValue
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetConsoleMode
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetEnvironmentStringsW
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFullPathNameA
GetFullPathNameW
GetLastError
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetQueuedCompletionStatusEx
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetSystemTimePreciseAsFileTime
GetTempPathA
GetTempPathW
GetThreadContext
GetThreadId
GetTickCount
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapValidate
InitOnceExecuteOnce
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
LockFile
LockFileEx
MapViewOfFile
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFile
ReleaseSRWLockExclusive
ResumeThread
RtlLookupFunctionEntry
RtlRestoreContext
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEndOfFile
SetErrorMode
SetEvent
SetFilePointer
SetProcessPriorityBoost
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SleepConditionVariableSRW
SuspendThread
SwitchToThread
SystemTimeToFileTime
TlsAlloc
TlsGetValue
TryAcquireSRWLockExclusive
TryEnterCriticalSection
UnlockFile
UnlockFileEx
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_acmdln
_aligned_free
_aligned_malloc
_amsg_exit
_beginthread
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_fmode
_initterm
_localtime64
_lock
_onexit
_strdup
_sys_nerr
_time64
_unlock
_vsnprintf
abort
calloc
clock
exit
fflush
fprintf
fputc
fputwc
free
fwprintf
fwrite
islower
isspace
isupper
iswctype
isxdigit
localeconv
malloc
memchr
qsort
realloc
signal
strcmp
strcpy
strcspn
strerror
strlen
strncmp
strrchr
strtol
strtoul
vfprintf
wcslen
wcstol
wcstoul
_GCC_specific_handler
_Unwind_DeleteException
_Unwind_ForcedUnwind
_Unwind_GetGR
_Unwind_GetIP
_Unwind_GetLanguageSpecificData
_Unwind_GetRegionStart
_Unwind_RaiseException
_Unwind_Resume
_Unwind_SetGR
_Unwind_SetIP
_cgo_dummy_export
authorizerTrampoline
callbackTrampoline
commitHookTrampoline
compareTrampoline
doneTrampoline
onOperationProgressCalled
preUpdateHookTrampoline
rollbackHookTrampoline
stepTrampoline
unw_get_fpreg
unw_get_proc_info
unw_get_proc_name
unw_get_reg
unw_getcontext
unw_init_local
unw_is_fpreg
unw_is_signal_frame
unw_local_addr_space
unw_regname
unw_resume
unw_set_fpreg
unw_set_reg
unw_step
updateHookTrampoline
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ