2024-08-14_4b53a0962979a80c3a86f841e723f42f_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-08-14_4b53a0962979a80c3a86f841e723f42f_ryuk
Size

10.7MB
MD5

4b53a0962979a80c3a86f841e723f42f
SHA1

b1a729ff5d7718dfeeee75c734d5c3c35145d93a
SHA256

e030b9fef0b6946a37bf0e3a9ee6a81b29a97cf8f71a4146cf51f1bde510178d
SHA512

2c3ac433606ee5f44ca6bf675e61bdce4bc6d35889410bebb3059c41a006d0cf198a08d20cc5917eab0fbd3c89c0ea3a07f9e444ffca580cfc23b229b9ff5ea9
SSDEEP

196608:Ou9MpKuUQ8x89hqMktQ8yjkZ0qSZqvY8z7I:OuyptUQ8x89hqjtLyjkZ0q2H

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-08-14_4b53a0962979a80c3a86f841e723f42f_ryuk

Files

2024-08-14_4b53a0962979a80c3a86f841e723f42f_ryuk
.exe windows:5 windows x64 arch:x64

be666148651d9e63cb467d62e45822c6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Mercurial\Projects\zandronum-stable-vs-64\RelWithDebInfo\zandronum.pdb

Imports

wsock32

bind
getsockopt
select
htonl
closesocket
getservbyport
shutdown
getservbyname
WSASetLastError
inet_ntoa
ioctlsocket
inet_addr
gethostbyaddr
send
recv
connect
gethostname
setsockopt
ntohs
getsockname
WSAGetLastError
WSACleanup
WSAStartup
gethostbyname
socket
sendto
recvfrom
htons

winmm

midiStreamOpen
timeGetDevCaps
timeBeginPeriod
timeGetTime
timeSetEvent
timeKillEvent
timeEndPeriod
midiOutGetNumDevs
midiOutGetDevCapsA
midiStreamClose
midiStreamProperty
midiStreamOut
midiStreamRestart
midiStreamStop
midiOutGetVolume
midiOutSetVolume
midiOutPrepareHeader
midiOutUnprepareHeader
midiOutShortMsg
midiOutReset
mciSendCommandA

ole32

CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
CoSetProxyBlanket

user32

CreatePopupMenu
GetDlgItemTextA
DrawAnimatedRects
EnumDisplayMonitors
GetMonitorInfoA
ChangeDisplaySettingsExA
GetDesktopWindow
AdjustWindowRectEx
CreateIconIndirect
DestroyCursor
SetParent
SetClassLongPtrA
GetAsyncKeyState
GetDlgCtrlID
SendDlgItemMessageA
SetDlgItemTextA
MapDialogRect
LoadImageA
LoadIconA
LoadCursorA
SetRect
FillRect
GetWindowTextLengthA
DrawIcon
SendMessageW
GetMessageA
wsprintfA
GetClassLongPtrA
ClipCursor
GetCursorPos
SetCursorPos
DestroyMenu
IsDialogMessageA
SetCursor
InvalidateRect
ReleaseCapture
SetCapture
MapVirtualKeyA
GetKeyState
IsClipboardFormatAvailable
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
PostQuitMessage
TranslateMessage
GetUpdateRect
EndPaint
BeginPaint
UnregisterClassA
RegisterClassA
DefWindowProcA
PeekMessageA
DispatchMessageA
MsgWaitForMultipleObjects
EnumDisplaySettingsA
GetFocus
GetActiveWindow
ReleaseDC
GetDC
SetWindowLongA
GetWindowLongA
GetSystemMetrics
AppendMenuA
TrackPopupMenu
SetActiveWindow
SystemParametersInfoA
GetForegroundWindow
GetScrollInfo
SetScrollInfo
GetParent
SetWindowLongPtrA
GetWindowLongPtrA
ScreenToClient
ClientToScreen
MessageBeep
MessageBoxA
GetWindowRect
GetClientRect
GetWindowTextA
SetWindowTextA
ScrollWindow
SetForegroundWindow
UpdateWindow
EnableWindow
KillTimer
SetTimer
SetFocus
IsDlgButtonChecked
CheckDlgButton
GetDlgItem
EndDialog
DialogBoxParamA
CreateDialogParamA
SendMessageA
CallWindowProcA
CreateWindowExA
DestroyWindow
ShowWindow
MoveWindow
SetWindowPos
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation

gdi32

SetBkColor
GetMapMode
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
CreateBitmap
BitBlt
SelectPalette
RealizePalette
GetSystemPaletteEntries
GetStockObject
DeleteObject
CreatePalette
Rectangle
SetMapMode
GetObjectA
DPtoLP
CreateFontIndirectA
CreateSolidBrush
GetDeviceCaps
GetTextExtentPoint32A
SetBkMode
StretchDIBits
SetTextColor
SetTextAlign
GetTextMetricsA
TextOutA
CreateBrushIndirect
CreateFontA
SetPixelV
CreateDIBSection
ExtTextOutA
ChoosePixelFormat
DescribePixelFormat
SetPixelFormat
GetDeviceGammaRamp
SetDeviceGammaRamp
SwapBuffers
SelectObject

comctl32

ord6
ord17

comdlg32

GetSaveFileNameA

oleaut32

SysFreeString
SysAllocString

opengl32

glShadeModel
glLineWidth
glHint
glFogi
glFinish
glClearDepth
glTexEnvi
glPixelStorei
glGetString
glNormal3fv
glIsEnabled
glDepthRange
glClipPlane
glReadPixels
glPolygonOffset
glGetIntegerv
glGetBooleanv
glFrustum
glFlush
glDrawBuffer
glDepthFunc
glCopyTexSubImage2D
glColor4fv
glVertex3fv
glTranslatef
glScalef
glRotatef
glPushMatrix
glDrawArrays
glStencilOp
glStencilFunc
glPopMatrix
glDepthMask
glColorMask
glTexParameteri
glTexParameterf
glTexCoord2fv
glGenTextures
glDeleteTextures
glBindTexture
glTexGeni
glFogfv
glFogf
glViewport
glVertex3f
glVertex2i
glVertex2f
glVertex2d
glTexCoord2f
glScissor
glOrtho
glMatrixMode
glLoadIdentity
glEnd
glEnable
glDisable
glColor4ub
glColor4f
glColor3ub
glColor3f
glClearColor
glClear
glBlendFunc
glBegin
glAlphaFunc
glVertexPointer
glTexCoordPointer
glEnableClientState
glDisableClientState
wglMakeCurrent
wglGetProcAddress
wglDeleteContext
wglCreateContext
glFrontFace
glDrawElements
glTexImage2D

glu32

gluScaleImage
gluPerspective

crypt32

CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertOpenStore
CertGetCertificateContextProperty
CertCloseStore

kernel32

IsProcessorFeaturePresent
TryEnterCriticalSection
AreFileApisANSI
GetFullPathNameW
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
CreateFileW
GetFileAttributesW
GetVersionExW
HeapValidate
HeapSize
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapCompact
HeapDestroy
UnlockFile
LockFileEx
SystemTimeToFileTime
GetSystemTime
CreateFileMappingW
GetTickCount
FlushFileBuffers
ReadConsoleW
GetConsoleMode
LoadLibraryW
FindNextFileW
FindFirstFileW
GetEnvironmentVariableW
MultiByteToWideChar
GetModuleHandleW
GetFileType
GetSystemTimeAsFileTime
GetModuleHandleExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
VirtualFree
VirtualProtect
IsDebuggerPresent
GetSystemInfo
OutputDebugStringA
GetSystemDirectoryA
SearchPathA
CreateProcessA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
PeekNamedPipe
CreatePipe
SetLastError
GetStartupInfoW
InitializeSListHead
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlPcToFileHeader
RaiseException
RtlUnwindEx
LoadLibraryExW
GetCommandLineW
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetConsoleCtrlHandler
GetDriveTypeW
SetFilePointerEx
UnhandledExceptionFilter
FreeLibraryAndExitThread
LoadLibraryExA
SetEnvironmentVariableA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetCurrentDirectoryW
GetConsoleCP
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
CreateDirectoryW
RemoveDirectoryW
TerminateProcess
HeapFree
HeapReAlloc
HeapCreate
WideCharToMultiByte
GetACP
lstrcpyA
SuspendThread
SetConsoleTextAttribute
GetLocaleInfoA
QueryPerformanceFrequency
QueryPerformanceCounter
FindNextFileA
FindFirstFileA
GetFileAttributesExA
FindClose
GetLongPathNameA
ReadConsoleA
AllocConsole
FlushConsoleInputBuffer
SetConsoleMode
GetCommandLineA
MulDiv
DuplicateHandle
GetStdHandle
GetFileInformationByHandle
QueueUserAPC
GetCurrentThread
SetUnhandledExceptionFilter
ExitProcess
RtlCaptureContext
SetPriorityClass
SleepEx
GlobalUnlock
GlobalLock
GlobalAlloc
GetVersionExA
CreateFileA
GetTempFileNameA
GetTempPathA
GetModuleHandleA
GetModuleFileNameA
LoadLibraryA
SetFilePointer
ReadFile
WriteFile
GetFileSize
GetExitCodeThread
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetProcessHeap
HeapAlloc
VirtualQuery
GetProcAddress
FreeLibrary
RtlVirtualUnwind
SetThreadPriority
CreateEventA
CloseHandle
WaitForMultipleObjects
ResetEvent
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
ExitThread
CreateThread
Sleep
WaitForSingleObject
FormatMessageA
GetLastError
LocalFree
SetStdHandle
FindFirstFileExA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlLookupFunctionEntry
CreateEventW
WriteConsoleW
GetExitCodeProcess

shell32

Shell_NotifyIconA
SHBrowseForFolderA
SHGetPathFromIDListA
ShellExecuteA
SHGetFolderPathA

advapi32

CryptReleaseContext
RegOpenKeyExA
RegQueryValueExA
CryptAcquireContextA
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptGenRandom
GetUserNameA
CredWriteA
CredReadA
CredFree
CryptAcquireContextW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptDestroyKey
CryptSetHashParam
RegCloseKey

Sections

.text
Size: 7.2MB - Virtual size: 7.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 172KB - Virtual size: 24.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 397KB - Virtual size: 397KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 773KB - Virtual size: 773KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

be666148651d9e63cb467d62e45822c6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wsock32

winmm

ole32

user32

gdi32

comctl32

comdlg32

oleaut32

opengl32

glu32

crypt32

kernel32

shell32

advapi32

Sections

.text Size: 7.2MB - Virtual size: 7.2MB

.rdata Size: 2.0MB - Virtual size: 2.0MB

.data Size: 172KB - Virtual size: 24.1MB

.pdata Size: 397KB - Virtual size: 397KB

.text Size: 6KB - Virtual size: 6KB

.tls Size: 512B - Virtual size: 9B

.gfids Size: 512B - Virtual size: 436B

_RDATA Size: 44KB - Virtual size: 44KB

.rsrc Size: 773KB - Virtual size: 773KB

.reloc Size: 99KB - Virtual size: 99KB

.text
Size: 7.2MB - Virtual size: 7.2MB

.rdata
Size: 2.0MB - Virtual size: 2.0MB

.data
Size: 172KB - Virtual size: 24.1MB

.pdata
Size: 397KB - Virtual size: 397KB

.text
Size: 6KB - Virtual size: 6KB

.tls
Size: 512B - Virtual size: 9B

.gfids
Size: 512B - Virtual size: 436B

_RDATA
Size: 44KB - Virtual size: 44KB

.rsrc
Size: 773KB - Virtual size: 773KB

.reloc
Size: 99KB - Virtual size: 99KB