2024-08-09_20aca46003735732efed99dd112c7b51_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-08-09_20aca46003735732efed99dd112c7b51_ryuk
Size

5.8MB
MD5

20aca46003735732efed99dd112c7b51
SHA1

6bd5f419d53281accc2b247eaf441e5bcb3d0221
SHA256

032c25f6b2fd7b0b0a022906b490dc594708c1cc7db99fca00d9b386d8b2d68e
SHA512

5933da4f0c2170d0fb414ba66eaeeef87f4b3c84247875797c923cb657eab782f02d5fc22a248f5b324eb62216b3fef6724a52d3ac275260722d5ecbf90c45c9
SSDEEP

98304:NUEPxzeQHsfT46QNliRFQrEt498kcq78CfY:NUEPxzeQHsfT46QNliRFQrEt498kJ7dg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-08-09_20aca46003735732efed99dd112c7b51_ryuk

Files

2024-08-09_20aca46003735732efed99dd112c7b51_ryuk
.exe windows:6 windows x64 arch:x64

bf4752893ad21233f599d4f61eadbbd5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCloseKey
RegEnumValueA
RegOpenKeyExA
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
CryptDestroyHash

ws2_32

htons
getpeername
send
recv
inet_pton
freeaddrinfo
getaddrinfo
WSASocketW
WSASend
WSARecv
WSAIoctl
WSAGetLastError
WSASetLastError
ntohs
select
listen
htonl
getsockopt
getsockname
ioctlsocket
connect
closesocket
bind
accept
__WSAFDIsSet
WSACleanup
WSAStartup
socket
setsockopt

kernel32

IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
GetProcessHeap
GetCurrentDirectoryW
FlushFileBuffers
SetFilePointerEx
GetTimeZoneInformation
SetEnvironmentVariableW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetACP
GetCommandLineW
GetCommandLineA
VerSetConditionMask
CloseHandle
GetLastError
SetLastError
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
WaitForSingleObject
SleepEx
CreateEventW
SetWaitableTimer
QueueUserAPC
TerminateThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
WaitForMultipleObjects
CreateWaitableTimerA
VerifyVersionInfoA
GetSystemTimeAsFileTime
Sleep
GetSystemTime
InitOnceExecuteOnce
FreeLibrary
GetProcAddress
LoadLibraryA
ExpandEnvironmentStringsA
QueryPerformanceFrequency
QueryPerformanceCounter
GetOEMCP
SetEnvironmentVariableA
VirtualAlloc
VirtualFree
VirtualProtect
InitializeCriticalSection
TryEnterCriticalSection
GetCurrentProcessId
GetCurrentThreadId
ReleaseSemaphore
SwitchToThread
ResetEvent
GetModuleFileNameA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
SetThreadAffinityMask
GetProcessAffinityMask
GetCurrentProcess
GetCurrentThread
GetModuleHandleA
FreeLibraryAndExitThread
HeapCreate
LocalAlloc
GetSystemDirectoryW
GetFileAttributesW
CreateFileW
LocalFree
GetModuleHandleW
LoadLibraryExW
GetFullPathNameW
VerifyVersionInfoW
GetTickCount
GetSystemDirectoryA
FormatMessageA
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
HeapSize
SetEndOfFile
DuplicateHandle
WaitForSingleObjectEx
GetExitCodeThread
WideCharToMultiByte
MultiByteToWideChar
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
GetModuleFileNameW
GetVersionExW
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
ExitProcess
GetModuleHandleExW
ExitThread
SetStdHandle
GetFileType
ReadFile
GetDriveTypeW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetStdHandle
WriteFile

Exports

Exports

NvOptimusEnablementCuda
curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_version
curl_version_info

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 467KB - Virtual size: 467KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 337B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.nv_fatb
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.nvFatBi
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bf4752893ad21233f599d4f61eadbbd5

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

ws2_32

kernel32

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 467KB - Virtual size: 467KB

.data Size: 26KB - Virtual size: 46KB

.pdata Size: 60KB - Virtual size: 59KB

.tls Size: 512B - Virtual size: 337B

.nv_fatb Size: 4.1MB - Virtual size: 4.1MB

.nvFatBi Size: 512B - Virtual size: 24B

.gfids Size: 3KB - Virtual size: 2KB

.rsrc Size: 56KB - Virtual size: 55KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 467KB - Virtual size: 467KB

.data
Size: 26KB - Virtual size: 46KB

.pdata
Size: 60KB - Virtual size: 59KB

.tls
Size: 512B - Virtual size: 337B

.nv_fatb
Size: 4.1MB - Virtual size: 4.1MB

.nvFatBi
Size: 512B - Virtual size: 24B

.gfids
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 56KB - Virtual size: 55KB

.reloc
Size: 8KB - Virtual size: 7KB