2024-08-08_75444aad2f54d14e6032aaab02fe27fc_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-08-08_75444aad2f54d14e6032aaab02fe27fc_ryuk
Size

3.4MB
MD5

75444aad2f54d14e6032aaab02fe27fc
SHA1

8f5999427bb52d45585abde0a16a6407ed8fcbd2
SHA256

bc4bc5d0f8db52d65db0f9413770a50db4a4708ad57f8d5358ebcdc9d45c486f
SHA512

67ece7a5e484071b02a153a8ac59ab9a75db848dbd8a52539e7f37b74e7e0eff88948fc88e9a69caa5fa8473baec136170edde563d68aedd3d9226cbac0e5f66
SSDEEP

49152:h5RFOf0RbZouwsTq2buWIePnyAGRINzXn2dz3DNVw/QrWLHUvv575s9kFuGbOh9c:hUAbOJsqtCNnyK4vQ9kn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-08-08_75444aad2f54d14e6032aaab02fe27fc_ryuk

Files

2024-08-08_75444aad2f54d14e6032aaab02fe27fc_ryuk
.exe windows:5 windows x64 arch:x64

f5855aa180da849c34969aaed0139dc1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\projects\shaka-packager\src\out\Release_x64\packager.exe.pdb

Imports

ws2_32

bind
ntohs
closesocket
freeaddrinfo
getaddrinfo
WSAIoctl
ioctlsocket
getsockopt
getsockname
getpeername
connect
send
recv
WSASetLastError
select
__WSAFDIsSet
WSAGetLastError
inet_pton
WSACleanup
WSAStartup
socket
setsockopt
recvfrom
ntohl
htons
htonl

crypt32

CertFreeCertificateContext

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime

shlwapi

PathMatchSpecA

advapi32

CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
SystemFunction036
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

kernel32

GetProcessHeap
GetDriveTypeW
GetFileType
SetStdHandle
GetFullPathNameA
GetFullPathNameW
ExitProcess
PeekNamedPipe
GetConsoleCP
LoadLibraryExW
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetStdHandle
GetCommandLineA
GetACP
ReadConsoleW
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
WriteConsoleW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetConsoleMode
GetCurrentDirectoryW
CreateFileW
DeleteFileW
WriteFile
OutputDebugStringA
CloseHandle
GetLastError
SetLastError
GetCurrentProcessId
GetTickCount
GetModuleFileNameW
FormatMessageA
GetCommandLineW
LocalFree
IsDebuggerPresent
RtlCaptureStackBackTrace
SetUnhandledExceptionFilter
GetCurrentProcess
GetCurrentThread
DuplicateHandle
RaiseException
WaitForSingleObject
Sleep
CreateThread
GetCurrentThreadId
SetThreadPriority
GetThreadPriority
GetModuleHandleW
GetProcAddress
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
QueryThreadCycleTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
GetModuleHandleExW
QueueUserWorkItem
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryW
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
SetEvent
CreateEventW
GetVersionExW
GetNativeSystemInfo
ResetEvent
WaitForMultipleObjects
ReleaseSRWLockShared
AcquireSRWLockShared
GetSystemInfo
HeapSize
GetModuleHandleA
VirtualQuery
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CreateDirectoryW
GetFileAttributesW
GetFileAttributesExW
GetLongPathNameW
GetTempFileNameW
ReadFile
RemoveDirectoryW
SetFileAttributesW
GetTempPathW
MoveFileW
ReplaceFileW
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
FlushFileBuffers
GetFileInformationByHandle
SetEndOfFile
SetFilePointerEx
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
HeapAlloc
HeapReAlloc
HeapFree
InitializeSRWLock
InitializeCriticalSectionAndSpinCount
InitOnceExecuteOnce
GetTickCount64
InitializeCriticalSectionEx
FreeLibrary
SleepEx
WaitForSingleObjectEx
MultiByteToWideChar
WideCharToMultiByte
VerSetConditionMask
GetSystemDirectoryW
VerifyVersionInfoW
ExpandEnvironmentStringsA
ReleaseMutex
CreateMutexW
GetModuleFileNameA
CreateFileA
GetTimeZoneInformation
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
VirtualProtect
LoadLibraryExA
EncodePointer
DecodePointer
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
RtlCaptureContext

ole32

CoInitializeEx
CoUninitialize

Exports

Exports

GetHandleVerifier

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 588KB - Virtual size: 587KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 153KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 25B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f5855aa180da849c34969aaed0139dc1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

crypt32

winmm

shlwapi

advapi32

kernel32

ole32

Exports

Exports

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 588KB - Virtual size: 587KB

.data Size: 18KB - Virtual size: 44KB

.pdata Size: 153KB - Virtual size: 153KB

.tls Size: 512B - Virtual size: 25B

.gfids Size: 2KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 920B

.reloc Size: 18KB - Virtual size: 18KB

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 588KB - Virtual size: 587KB

.data
Size: 18KB - Virtual size: 44KB

.pdata
Size: 153KB - Virtual size: 153KB

.tls
Size: 512B - Virtual size: 25B

.gfids
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 920B

.reloc
Size: 18KB - Virtual size: 18KB