2024-07-24_c5beb30196d57691283aeff743cf7978_ryuk

Sharing

Copy URL

Twitter E-mail

General

Target

2024-07-24_c5beb30196d57691283aeff743cf7978_ryuk
Size

11.7MB
MD5

c5beb30196d57691283aeff743cf7978
SHA1

13d22afee34bb318156ee39ced16829a8719a021
SHA256

a29e8a0868a5883ce838f862bca31cd26e07b5a7a25c7d0a25bbc1a9831fee23
SHA512

3495e014bd9562d989cda23affe57cec3ae7b91d7a6619521731ce8a568114dd08dd32c4f389b6a35bacff75be73a4b6e924d026419bfe93fd3f9f0eebc283b6
SSDEEP

98304:lvGtnIMBLZmI+CDuJ/pimNQgMLMbKMWqshc1ZWTUxxtCarnlkREX/o5X/oPmMQR:cIM1ZmIHuJOgMLcWi1ZZxxI+X/gX/a+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-07-24_c5beb30196d57691283aeff743cf7978_ryuk

Files

2024-07-24_c5beb30196d57691283aeff743cf7978_ryuk
.exe windows:6 windows x64 arch:x64

0687cba899083c253cd0f8a7b2bca150

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

FormatMessageW
GetLastError
GetFileAttributesExW
OutputDebugStringW
TerminateThread
DeleteFileW
GetNativeSystemInfo
LoadLibraryW
GetCurrentDirectoryW
GetOverlappedResult
SetCurrentDirectoryW
ReplaceFileW
DeleteCriticalSection
ExitProcess
VerSetConditionMask
CopyFileW
VerifyVersionInfoW
CreateFileMappingW
MapViewOfFile
MoveFileW
GetDriveTypeW
IsDebuggerPresent
ConnectNamedPipe
SetUnhandledExceptionFilter
FlushFileBuffers
GetCommandLineW
AttachConsole
LocalFree
GlobalSize
GlobalAlloc
GlobalLock
GetCurrentProcessId
GlobalUnlock
RtlVirtualUnwind
GetStdHandle
GetFileType
GetModuleHandleW
GetTickCount
GlobalMemoryStatus
FlushConsoleInputBuffer
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetProcessHeap
SetStdHandle
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
UnmapViewOfFile
GetDateFormatW
ReadConsoleW
GetConsoleCP
SetFilePointerEx
GetACP
GetModuleFileNameA
HeapFree
HeapReAlloc
HeapAlloc
SetConsoleMode
ReadConsoleInputA
GetConsoleMode
SetConsoleCtrlHandler
FreeLibraryAndExitThread
ExitThread
CreateThread
GetTimeZoneInformation
GetModuleHandleExW
LoadLibraryExW
RtlUnwindEx
RaiseException
RtlPcToFileHeader
FormatMessageA
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetStringTypeW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
DecodePointer
EncodePointer
WideCharToMultiByte
GetLogicalDriveStringsW
DisconnectNamedPipe
GetPriorityClass
GetModuleHandleA
ResetEvent
GetThreadPriority
GetCurrentThread
Sleep
MultiByteToWideChar
CreateEventW
WaitForSingleObject
SetThreadPriority
GetCurrentProcess
SetPriorityClass
FreeLibrary
GetProcAddress
LoadLibraryA
QueryPerformanceFrequency
GetWindowsDirectoryA
GetVersionExA
CreateFileA
DeviceIoControl
GetSystemDirectoryW
ReleaseMutex
GetCurrentThreadId
GetFileAttributesW
CreateFileW
GetLocaleInfoW
FindClose
CreateMutexW
GetTempPathW
SetEndOfFile
SetFilePointer
InitializeCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
GetModuleFileNameW
RemoveDirectoryW
TerminateProcess
WriteFile
FindNextFileW
EnterCriticalSection
FindFirstFileW
CancelIo
GetVolumeInformationW
TryEnterCriticalSection
ReadFile
SetThreadAffinityMask
GetTimeFormatW
CreateDirectoryW
CreateEventA
QueryPerformanceCounter
CloseHandle
WaitForSingleObjectEx
SetEvent
WriteConsoleW

user32

RegisterClassExW
GetWindowLongPtrW
EnumWindows
PeekMessageW
DispatchMessageW
GetFocus
SendMessageTimeoutW
PostMessageW
GetMessageW
EndPaint
BeginPaint
GetCursorPos
ReleaseDC
SetCursorPos
InvalidateRect
SetForegroundWindow
ReleaseCapture
GetParent
UnregisterClassW
EnableMenuItem
ShowCaret
GetClientRect
SetWindowLongW
CreateWindowExW
GetDesktopWindow
SetClipboardData
SetCapture
DestroyCaret
LoadCursorW
FindWindowW
GetClipboardData
SetLayeredWindowAttributes
GetMessageTime
GetForegroundWindow
TrackMouseEvent
CreateCaret
IsChild
EmptyClipboard
CloseClipboard
CreateIconIndirect
GetMonitorInfoW
GetWindowInfo
DestroyIcon
RedrawWindow
GetCapture
OpenClipboard
GetAsyncKeyState
ShowWindow
GetActiveWindow
SetCaretPos
GetKeyboardState
ToUnicode
MessageBoxA
DestroyCursor
GetWindowPlacement
WindowFromPoint
SetWindowLongPtrW
SetFocus
TranslateMessage
GetWindowTextW
GetWindowThreadProcessId
AttachThreadInput
DefWindowProcW
SetCursor
DestroyWindow
EnumDisplayMonitors
EnumChildWindows
MessageBoxW
SetWindowPos
IsWindowVisible
GetDC
GetWindowRect
MapVirtualKeyW
GetMessagePos
GetUpdateRgn
GetMessageExtraInfo
GetSystemMenu
GetWindowLongW
MoveWindow
GetIconInfo
ScreenToClient
SendMessageW
GetSystemMetrics
SetWindowTextW
MessageBeep
CallWindowProcW
GetProcessWindowStation
GetUserObjectInformationW
SystemParametersInfoW

gdi32

SwapBuffers
SaveDC
CreateDIBSection
StretchDIBits
CreateRectRgnIndirect
GetPixel
CreateRectRgn
GetRegionData
GetObjectW
ExcludeClipRect
RestoreDC
CreateBitmap
CombineRgn
AddFontMemResourceEx
SelectObject
GetKerningPairsW
CreateCompatibleDC
EnumFontFamiliesExW
GetDeviceCaps
GetTextMetricsW
DeleteDC
SetMapperFlags
GetGlyphIndicesW
GetGlyphOutlineW
DeleteObject
RemoveFontMemResourceEx
SetMapMode
CreateFontIndirectW
GetOutlineTextMetricsW

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

ReportEventW
RegisterEventSourceW
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyA
RegCloseKey
RegQueryValueExW
RegOpenKeyW
RegOpenKeyExW
RegEnumKeyW
RegSetValueExW
RegCreateKeyExW
DeregisterEventSource

shell32

SHGetSpecialFolderPathW
ShellExecuteW
ExtractAssociatedIconW
SHBrowseForFolderW
ShellExecuteA
SHGetPathFromIDListW
SHGetMalloc
Shell_NotifyIconW

ole32

OleCreate
OleSetContainedObject
RevokeDragDrop
RegisterDragDrop
DoDragDrop
OleInitialize
OleUninitialize
CLSIDFromString
CoTaskMemFree
CoCreateInstance
PropVariantClear
CoInitialize
CoTaskMemAlloc

oleaut32

SafeArrayAccessData
SafeArrayCreateVector
SafeArrayUnaccessData
SysAllocString
SysFreeString
VariantInit
SafeArrayDestroy
VariantClear

wininet

InternetReadFile
InternetSetOptionW
InternetWriteFile
InternetCloseHandle
HttpSendRequestExW
HttpEndRequestW
InternetCrackUrlW
InternetSetFilePointer
HttpQueryInfoW
InternetOpenW
InternetQueryOptionW
HttpOpenRequestW
InternetConnectW
FtpOpenFileW

ws2_32

inet_ntoa
recv
getsockopt
setsockopt
send
WSAStartup
select
closesocket
accept
__WSAFDIsSet

shlwapi

PathStripToRootW

winmm

midiOutOpen
midiOutGetDevCapsW
midiInOpen
midiInUnprepareHeader
midiInReset
midiInPrepareHeader
midiOutUnprepareHeader
midiInGetDevCapsW
midiInStart
midiInClose
midiInGetNumDevs
midiOutShortMsg
midiOutGetNumDevs
midiOutLongMsg
midiInAddBuffer
midiOutClose
midiInStop
timeKillEvent
timeGetTime
timeBeginPeriod
midiOutPrepareHeader

imm32

ImmNotifyIME
ImmGetCompositionStringW
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow

opengl32

wglGetProcAddress
glTexParameteri
glDeleteTextures
glClearColor
glGetBooleanv
glDrawArrays
glTexImage2D
glReadPixels
glDisable
wglMakeCurrent
glPixelStorei
glTexSubImage2D
glGetString
glGetError
glGetIntegerv
wglGetCurrentContext
glBlendFunc
glEnable
glGenTextures
glBindTexture
glViewport
glClear
glDrawElements

Sections

.text
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6.6MB - Virtual size: 6.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 225KB - Virtual size: 265KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 222KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 33B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 249KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 632KB - Virtual size: 636KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0687cba899083c253cd0f8a7b2bca150

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

wininet

ws2_32

shlwapi

winmm

imm32

opengl32

Sections

.text Size: 3.9MB - Virtual size: 3.9MB

.rdata Size: 6.6MB - Virtual size: 6.6MB

.data Size: 225KB - Virtual size: 265KB

.pdata Size: 222KB - Virtual size: 222KB

.gfids Size: 1024B - Virtual size: 576B

.tls Size: 512B - Virtual size: 33B

_RDATA Size: 10KB - Virtual size: 9KB

.rsrc Size: 249KB - Virtual size: 248KB

.reloc Size: 632KB - Virtual size: 636KB

.text
Size: 3.9MB - Virtual size: 3.9MB

.rdata
Size: 6.6MB - Virtual size: 6.6MB

.data
Size: 225KB - Virtual size: 265KB

.pdata
Size: 222KB - Virtual size: 222KB

.gfids
Size: 1024B - Virtual size: 576B

.tls
Size: 512B - Virtual size: 33B

_RDATA
Size: 10KB - Virtual size: 9KB

.rsrc
Size: 249KB - Virtual size: 248KB

.reloc
Size: 632KB - Virtual size: 636KB