Static task
static1
Behavioral task
behavioral1
Sample
2024-09-29_538725225dc66814525e8243066552f9_ryuk.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-29_538725225dc66814525e8243066552f9_ryuk.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-29_538725225dc66814525e8243066552f9_ryuk
-
Size
34.1MB
-
MD5
538725225dc66814525e8243066552f9
-
SHA1
c310def48f0ee42f1bc191a53cfefee1b803371c
-
SHA256
fba67ba1bb4ffbb6c78b8ff3ccb2baed668d377cb9fd843381b6646ed3474051
-
SHA512
b8890634865544540cce468be53cdc001d5b0f522fd6f177ac9c30d8e7abf762bb1e5256d31d82f8fe1941a3285593d1d41e085f8cde749bb7f32e8f33f31b06
-
SSDEEP
24576:wyyyyyMrYo+ooo7oocJBQFhE4u9Otxsl4wm:KskF1u9Ovw7m
Malware Config
Signatures
Files
-
2024-09-29_538725225dc66814525e8243066552f9_ryuk.exe windows:6 windows x64 arch:x64
16be216c42653d9831887f17f52488fc
Code Sign
32:23:ef:72:6c:28:37:9f:47:ee:26:47:79:2f:b0:1cCertificate
IssuerCN=FortuneSmileWorkTeam,L=Scottsdale,ST=Arizona,C=USNot Before09/03/2023, 00:00Not After09/03/2024, 23:59SubjectCN=FortuneSmileWorkTeam,L=Scottsdale,ST=Arizona,C=USSigner
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
HeapReAlloc
GetModuleHandleA
InitializeCriticalSectionEx
HeapSize
DeleteCriticalSection
MultiByteToWideChar
HeapDestroy
SetHandleInformation
WideCharToMultiByte
VerLanguageNameA
RemoveDirectoryW
OpenMutexA
OpenEventA
MapUserPhysicalPagesScatter
GetUserDefaultLocaleName
GetSystemTime
GetSystemPreferredUILanguages
GetProcessIoCounters
GetConsoleCursorInfo
FillConsoleOutputCharacterW
GetProcAddress
WriteConsoleW
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
SetStdHandle
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
IsDebuggerPresent
OutputDebugStringW
RaiseException
GetLastError
EnterCriticalSection
LeaveCriticalSection
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlUnwindEx
SetLastError
GetCurrentProcess
TerminateProcess
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
GetFileType
CompareStringW
LCMapStringW
GetStringTypeW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
CreateFileW
gdi32
CreatePenIndirect
SetWinMetaFileBits
GetDCOrgEx
AbortPath
advapi32
RegLoadAppKeyW
RegDisableReflectionKey
OpenEventLogW
LookupAccountNameA
DestroyPrivateObjectSecurity
CredWriteDomainCredentialsA
CredWriteA
CreatePrivateObjectSecurity
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOverridePredefKey
shlwapi
SHRegSetUSValueA
StrCatBuffW
ord153
SHRegOpenUSKeyW
oledlg
ord8
ord4
ord9
OleUIAddVerbMenuW
Sections
.text Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 127KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32.2MB - Virtual size: 32.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ