2024-07-26_4be84f51a3d46b88bd5e4f8f42cdbd12_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-07-26_4be84f51a3d46b88bd5e4f8f42cdbd12_ryuk
Size

1.1MB
MD5

4be84f51a3d46b88bd5e4f8f42cdbd12
SHA1

a9a75812f51b507bc1874c7fc3ea1ac8a287120b
SHA256

64224f990306d199c144d752c8695787da8f512779af4b6bcf5cce53ee15e401
SHA512

0ffa347e3ab0dea3f8b7e65b4134b53b23bdfc4612e6a34ba654ef3cc09a51b99e66e65b74d4ece87420baa080e54e613c494b5763b00040cfdf0735a559e7cd
SSDEEP

24576:KP9BZLIHcftyCr/RZEqiRqh0kIvOXC8lf/WSfEOq+n3CbMt:e9BhI8MCr/RSqiRqO58lf/WUEOqeV

Score

1^/10

Malware Config

Signatures

Files

2024-07-26_4be84f51a3d46b88bd5e4f8f42cdbd12_ryuk
.exe windows:6 windows x64 arch:x64

7b331a85c9ed152f938e9263bee958c9

Code Sign

33:00:00:02:cb:b7:75:39:fb:02:71:42:36:00:00:00:00:02:cb
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/05/2022, 20:45

Not After

11/05/2023, 20:45

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c0:03:d1:2f:0e:a2:d5:94:9b:af:d1:fc:75:3b:fc:22:8b:b7:b4:12:bb:8d:67:4e:b1:6a:3c:39:dd:3f:91:b2
Signer

Actual PE Digest

c0:03:d1:2f:0e:a2:d5:94:9b:af:d1:fc:75:3b:fc:22:8b:b7:b4:12:bb:8d:67:4e:b1:6a:3c:39:dd:3f:91:b2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\_work\1\s\OSS_Microsoft_OpenSSH_Dev\bin\x64\Release\sshd.pdb

Imports

libcrypto

ECDH_compute_key
EC_POINT_clear_free
EC_GROUP_get_degree
DH_compute_key
DH_size
AES_set_encrypt_key
DSA_free
DSA_do_sign
DSA_get0_key
DSA_do_verify
DSA_set0_key
DSA_SIG_get0
DSA_new
DSA_SIG_new
DSA_set0_pqg
DSA_get0_pqg
DSA_generate_key
DSA_generate_parameters_ex
DSA_SIG_free
BN_dup
RSA_generate_key_ex
BN_set_flags
RSA_public_decrypt
RSA_new
RSA_set0_crt_params
RSA_free
BN_free
BN_set_word
RSA_sign
BN_div
RSA_set0_factors
RSA_size
RSA_get0_factors
RSA_get0_crt_params
RSA_set0_key
BN_CTX_new
BN_CTX_free
ECDSA_do_sign
EC_POINT_cmp
EC_KEY_set_private_key
DSA_SIG_set0
AES_encrypt
EC_KEY_generate_key
ECDSA_SIG_get0
ECDSA_SIG_free
ECDSA_SIG_set0
EC_KEY_set_asn1_flag
ECDSA_do_verify
EC_KEY_new_by_curve_name
ECDSA_SIG_new
RAND_status
SSLeay
EC_KEY_free
EVP_CIPHER_CTX_key_length
EVP_CIPHER_CTX_new
EVP_aes_256_cbc
EVP_CIPHER_CTX_iv_length
EVP_CipherInit
EVP_aes_128_ctr
EVP_aes_256_ctr
EVP_CIPHER_CTX_get_iv
EVP_des_ede3_cbc
EVP_aes_192_cbc
EVP_CIPHER_CTX_ctrl
EVP_CIPHER_CTX_set_key_length
EVP_aes_192_ctr
EVP_Cipher
EVP_aes_256_gcm
EVP_aes_128_gcm
EVP_CIPHER_CTX_free
EC_POINT_oct2point
BN_bn2bin
EC_KEY_set_public_key
EC_POINT_point2oct
BN_bin2bn
BN_is_bit_set
DH_get0_key
BN_hex2bn
DH_set_length
DH_new
BN_is_negative
DH_set0_pqg
DH_generate_key
EVP_sha384
EVP_MD_CTX_copy_ex
EVP_MD_CTX_new
EVP_md5
EVP_sha256
EVP_DigestUpdate
EVP_Digest
EVP_MD_CTX_free
EVP_DigestInit_ex
EVP_MD_CTX_md
EVP_sha1
EVP_MD_block_size
EVP_sha512
EVP_DigestFinal_ex
RSA_blinding_on
EC_GROUP_get_order
BIO_new
BN_clear_free
ERR_peek_error
BN_value_one
EVP_PKEY_get1_EC_KEY
EC_METHOD_get_field_type
EC_POINT_mul
ERR_get_error
EC_POINT_get_affine_coordinates_GFp
ERR_peek_last_error
EC_KEY_set_group
EC_POINT_is_at_infinity
BIO_s_mem
RSA_get0_key
PEM_read_bio_PrivateKey
EC_POINT_free
EVP_aes_128_cbc
EVP_PKEY_free
EVP_PKEY_get1_RSA
EC_KEY_get0_public_key
EC_GROUP_free
EC_POINT_new
BIO_write
BIO_free
EC_GROUP_cmp
EVP_PKEY_get1_DSA
EC_GROUP_set_asn1_flag
EC_GROUP_get_curve_name
BN_new
EC_KEY_get0_private_key
EC_KEY_get0_group
BN_cmp
BN_sub
EC_GROUP_new_by_curve_name
EVP_PKEY_base_id
EC_GROUP_method_of
BN_num_bits
timegm
RAND_poll
SSLeay_version
RAND_seed
arc4random_buf
RAND_bytes
DH_free
DH_get0_pqg
gettimeofday
explicit_bzero
arc4random_uniform

userenv

LoadUserProfileW

crypt32

CryptBinaryToStringA
CryptStringToBinaryA

ws2_32

htons
FreeAddrInfoW
bind
WSAIoctl
WSASend
shutdown
listen
WSAStartup
getpeername
getsockname
socket
htonl
GetAddrInfoW
WSARecv
getsockopt
WSAGetOverlappedResult
setsockopt
closesocket
WSADuplicateSocketW
WSASocketW
WSAGetLastError
ntohs
getservbyname
getnameinfo
gethostname
inet_ntop
ntohl
inet_ntoa

secur32

InitSecurityInterfaceW
FreeContextBuffer
LsaFreeReturnBuffer
LsaLookupAuthenticationPackage
LsaLogonUser
LsaDeregisterLogonProcess
LsaRegisterLogonProcess
LsaConnectUntrusted

kernel32

GetFullPathNameW
SetFileAttributesW
RemoveDirectoryW
SetStdHandle
GetCurrentDirectoryW
SetCurrentDirectoryW
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RtlUnwindEx
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
DeleteFileW
GetCommandLineA
GetCommandLineW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNextFileW
CreateThread
ExitThread
FreeLibraryAndExitThread
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
HeapReAlloc
GetTimeZoneInformation
GetFileSizeEx
GetStringTypeW
ReadConsoleW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
HeapSize
RaiseException
CancelIoEx
CancelSynchronousIo
WriteFile
ReadFile
WaitForSingleObjectEx
WaitForMultipleObjectsEx
GetDriveTypeW
GetDiskFreeSpaceExW
GetLogicalDriveStringsW
ReadFileEx
GetFileAttributesExW
GetFileInformationByHandle
WriteFileEx
DeviceIoControl
CreateNamedPipeA
CancelIo
ReadConsoleOutputA
SetConsoleCursorPosition
GetConsoleWindow
Beep
WriteConsoleW
FillConsoleOutputAttribute
WriteConsoleOutputA
CreateFileA
ReadConsoleInputW
SetConsoleCursorInfo
GetConsoleMode
SetConsoleWindowInfo
GetConsoleCP
GetConsoleCursorInfo
ScrollConsoleScreenBufferA
SetConsoleScreenBufferSize
SetConsoleTextAttribute
FillConsoleOutputCharacterA
LoadLibraryExW
MultiByteToWideChar
CreateWaitableTimerA
GetLocalTime
RtlPcToFileHeader
TerminateProcess
CancelWaitableTimer
QueueUserAPC
SetConsoleCtrlHandler
GetExitCodeProcess
GetModuleHandleExW
GetSystemTime
GetWindowsDirectoryW
GetSystemDirectoryW
CreateEventA
VerifyVersionInfoW
SleepEx
VerSetConditionMask
ResetEvent
SetEvent
FlushFileBuffers
OpenThread
SetFilePointerEx
GetTickCount64
GetCurrentThreadId
SetEndOfFile
SetHandleInformation
GetCurrentProcessId
GetFinalPathNameByHandleW
GetFileType
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryW
Sleep
CreateFileW
CreateWaitableTimerW
GetStdHandle
GetConsoleScreenBufferInfo
SetWaitableTimer
CreateDirectoryW
GetLastError
CloseHandle
GetComputerNameW
WaitForSingleObject
GetFileAttributesW
CreateProcessW
CopyFileW
SetInformationJobObject
GetCurrentProcess
ExpandEnvironmentStringsW
AssignProcessToJobObject
EncodePointer
SetEnvironmentVariableW
CreateJobObjectW
GetEnvironmentVariableW
DuplicateHandle
OpenProcess
FormatMessageW
LocalFree
FormatMessageA
GetModuleFileNameW
SetConsoleMode

user32

GetWindowPlacement
ShowWindow

advapi32

CreateProcessAsUserW
ConvertSidToStringSidA
EventWrite
EventWriteTransfer
GetTokenInformation
GetSidIdentifierAuthority
LookupAccountSidW
CheckTokenMembership
IsValidSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
RegCreateKeyExW
SetServiceStatus
RegCloseKey
RegEnumValueW
RegOpenKeyExW
IsWellKnownSid
LookupAccountNameW
IsValidAcl
GetLengthSid
OpenProcessToken
IsValidSecurityDescriptor
GetNamedSecurityInfoW
CopySid
CreateWellKnownSid
GetAce
RegQueryValueExW
LsaNtStatusToWinError
DuplicateToken
FreeSid
CreateRestrictedToken
LookupPrivilegeValueA
AllocateAndInitializeSid
EqualSid
AllocateLocallyUniqueId
AdjustTokenPrivileges
LsaManageSidNameMapping
EventRegister
ConvertSidToStringSidW
EventUnregister

Sections

.text
Size: 763KB - Virtual size: 763KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 331KB - Virtual size: 331KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7b331a85c9ed152f938e9263bee958c9

Code Sign

33:00:00:02:cb:b7:75:39:fb:02:71:42:36:00:00:00:00:02:cbCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

c0:03:d1:2f:0e:a2:d5:94:9b:af:d1:fc:75:3b:fc:22:8b:b7:b4:12:bb:8d:67:4e:b1:6a:3c:39:dd:3f:91:b2Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libcrypto

userenv

crypt32

ws2_32

secur32

kernel32

user32

advapi32

Sections

.text Size: 763KB - Virtual size: 763KB

.rdata Size: 331KB - Virtual size: 331KB

.data Size: 7KB - Virtual size: 223KB

.pdata Size: 38KB - Virtual size: 37KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 3KB - Virtual size: 2KB

33:00:00:02:cb:b7:75:39:fb:02:71:42:36:00:00:00:00:02:cb
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

c0:03:d1:2f:0e:a2:d5:94:9b:af:d1:fc:75:3b:fc:22:8b:b7:b4:12:bb:8d:67:4e:b1:6a:3c:39:dd:3f:91:b2
Signer

.text
Size: 763KB - Virtual size: 763KB

.rdata
Size: 331KB - Virtual size: 331KB

.data
Size: 7KB - Virtual size: 223KB

.pdata
Size: 38KB - Virtual size: 37KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 3KB - Virtual size: 2KB