2024-07-10_2444756e4da3bffc08b4ce48046d7220_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-07-10_2444756e4da3bffc08b4ce48046d7220_ryuk
Size

1.0MB
MD5

2444756e4da3bffc08b4ce48046d7220
SHA1

4ff2097944ac84c78c9f81b9eb551e1d1661d36c
SHA256

cfd499b165c23f25481f59691a4bccb213a7b724d43bdbd0b4b001f61a754fed
SHA512

53d78c0820e3980a5452b9866ee7f32d299262366a81547a40b2a858993f38ba0a4b025705ec753726770285d8a5c23c3910ae04799e0e9645d15689a8afeb6d
SSDEEP

6144:9it+ydRiSh0gjlCQ3fBzlX31LwVohVXn7vF1SOxyV1WqOxyV1W:5MRiW0Cl3vBXWoj37tVxznxz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-07-10_2444756e4da3bffc08b4ce48046d7220_ryuk

Files

2024-07-10_2444756e4da3bffc08b4ce48046d7220_ryuk
.exe windows:6 windows x64 arch:x64

5d1a708ca34a0a7336773c40df6761c5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CreateThread
GetLastError
TerminateThread
CloseHandle
GetSystemInfo
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
SetUnhandledExceptionFilter
GetModuleFileNameA
LoadLibraryA
GetProcAddress
GetLocalTime
CreateFileA
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetTickCount
DeleteCriticalSection
GetFileSize
WaitForSingleObject
HeapFree
GetProcessHeap
HeapAlloc
WriteConsoleW
InitializeCriticalSection
HeapSize
CreateFileW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
FlushFileBuffers
GetTimeZoneInformation
GetFileSizeEx
GetConsoleOutputCP
ReadConsoleW
LeaveCriticalSection
EnterCriticalSection
GetPrivateProfileStringA
GetPrivateProfileIntA
CreateDirectoryA
SetEndOfFile
GetTickCount64
GetConsoleMode
SetFilePointerEx
GetFileType
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
ExitProcess
HeapReAlloc
ReadFile
LoadLibraryExW
FreeLibrary
RtlUnwindEx
RaiseException
RtlPcToFileHeader
InitializeSListHead
VirtualQuery
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
WideCharToMultiByte
GetStringTypeW
MultiByteToWideChar
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
CompareStringW
LCMapStringW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter

user32

MessageBoxA
LoadAcceleratorsA
SetTimer
wsprintfA
SetWindowTextA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
LoadIconA
LoadCursorA
RegisterClassExA
CreateWindowExA
ShowWindow
UpdateWindow
DialogBoxParamA
DestroyWindow
DefWindowProcA
BeginPaint
EndPaint
GetDC
GetClientRect
FillRect
ReleaseDC
EndDialog
LoadStringA
PostQuitMessage

gdi32

SetTextColor
SelectObject
SetBkMode
CreateSolidBrush
GetStockObject
TextOutA

ws2_32

closesocket
WSASocketA
WSAGetLastError
htonl
htons
bind
listen
WSAAccept
inet_ntoa
WSARecv
WSASend
WSAStartup
recvfrom

Sections

.text
Size: 225KB - Virtual size: 225KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 206KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 292B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gehcont
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 726KB - Virtual size: 726KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5d1a708ca34a0a7336773c40df6761c5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

ws2_32

Sections

.text Size: 225KB - Virtual size: 225KB

.rdata Size: 95KB - Virtual size: 95KB

.data Size: 4KB - Virtual size: 206KB

.pdata Size: 9KB - Virtual size: 9KB

.gfids Size: 512B - Virtual size: 292B

.tls Size: 512B - Virtual size: 9B

.gehcont Size: 512B - Virtual size: 24B

.rsrc Size: 726KB - Virtual size: 726KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 225KB - Virtual size: 225KB

.rdata
Size: 95KB - Virtual size: 95KB

.data
Size: 4KB - Virtual size: 206KB

.pdata
Size: 9KB - Virtual size: 9KB

.gfids
Size: 512B - Virtual size: 292B

.tls
Size: 512B - Virtual size: 9B

.gehcont
Size: 512B - Virtual size: 24B

.rsrc
Size: 726KB - Virtual size: 726KB

.reloc
Size: 3KB - Virtual size: 3KB