2024-10-13_465d84707e80a2a950c96c56e8ef5a7a_ryuk

Sharing

Copy URL

Twitter E-mail

General

Target

2024-10-13_465d84707e80a2a950c96c56e8ef5a7a_ryuk
Size

26.3MB
MD5

465d84707e80a2a950c96c56e8ef5a7a
SHA1

78a38248c29af7a291c48dd7412190c31c4d5315
SHA256

22fb3abcabf32f673cd890fe7c942db281e20c737d07f10051a4527c1fb0333b
SHA512

b8a3ad8f263c8ea137b63c68b2ccf17cb15ca141ff38004babfe5ff32188bda7afd4fa3c62c18d2bdfa7a391160d068e0d10a55ca40fe703b154df46d17bf8f8
SSDEEP

786432:dTkcIvFB01SlhXuzDJS2eE0UW5dSOVRO:qcIFB0olhXMFSR9VU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-10-13_465d84707e80a2a950c96c56e8ef5a7a_ryuk

Files

2024-10-13_465d84707e80a2a950c96c56e8ef5a7a_ryuk
.exe windows:6 windows x64 arch:x64

eb210b7c2029319a5e610deeb626e85f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

Process32NextW
Process32FirstW
LoadLibraryW
GetProcAddress
GetModuleHandleW
CreateToolhelp32Snapshot
LocalFree
GetLastError
ResetEvent
GetSystemInfo
SetEvent
CreateEventW
CreateFileW
WriteFile
GetConsoleWindow
CreateThread
GetSystemWow64DirectoryW
GetSystemDirectoryW
WaitForSingleObject
K32EnumProcessModules
K32EnumProcesses
OutputDebugStringW
CompareStringW
GetUserDefaultLCID
GetCommandLineW
GetCurrentProcessId
DuplicateHandle
Sleep
WaitForMultipleObjects
GetCurrentProcess
SwitchToThread
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
GetThreadPriority
TerminateThread
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FormatMessageW
GetSystemTime
GetLocalTime
WaitForSingleObjectEx
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount
GetFileAttributesExW
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
FindClose
FindFirstFileW
GetFileAttributesW
GetFileInformationByHandle
GetFullPathNameW
GetLogicalDrives
GetLongPathNameW
RemoveDirectoryW
GetTempPathW
SetErrorMode
DeviceIoControl
CopyFileW
MoveFileW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FlushFileBuffers
GetFileType
ReadFile
SetEndOfFile
SetFilePointerEx
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
MoveFileExW
GetStdHandle
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetFilePointer
ConnectNamedPipe
CreateNamedPipeW
TerminateProcess
GetExitCodeProcess
CloseHandle
GetStartupInfoW
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
GetCurrencyFormatW
GetUserDefaultUILanguage
FindFirstFileExW
FindNextFileW
ReadFileEx
PeekNamedPipe
CancelIo
SleepEx
GetModuleHandleA
WriteFileEx
GetTimeZoneInformation
GetGeoInfoW
GetUserGeoID
FreeLibrary
GetModuleHandleExW
LoadLibraryA
ReleaseMutex
CreateMutexW
VirtualAlloc
VirtualFree
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
LCMapStringW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
LoadLibraryExW
GetVersionExW
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlPcToFileHeader
RaiseException
RtlUnwindEx
ExitProcess
GetCommandLineA
ExitThread
GetConsoleMode
ReadConsoleW
GetConsoleCP
SetFileAttributesW
SetStdHandle
HeapAlloc
HeapFree
HeapReAlloc
GetModuleFileNameA
GetACP
CreateProcessA
IsValidLocale
EnumSystemLocalesW
IsValidCodePage
GetOEMCP
SetEnvironmentVariableA
WriteConsoleW
GetProcessHeap
FindFirstFileExA
FindNextFileA
HeapSize
K32GetModuleBaseNameW
CreateProcessW
OpenProcess

user32

DestroyWindow
GetQueueStatus
MsgWaitForMultipleObjectsEx
SetTimer
KillTimer
GetWindowLongPtrW
SetWindowLongPtrW
SetWindowsHookExW
CreateWindowExW
CallNextHookEx
CharNextExA
EnumWindows
PostThreadMessageW
PostMessageW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
UnregisterClassW
UnhookWindowsHookEx
RegisterClassW
ShowWindow
MessageBoxW
GetWindowThreadProcessId

advapi32

OpenProcessToken
GetLengthSid
CopySid
GetTokenInformation
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
FreeSid
RegEnumValueW
RegFlushKey
RegSetValueExW

ws2_32

WSAAsyncSelect

rpcrt4

RpcStringFreeA
UuidToStringA
UuidCreate

shell32

SHGetSpecialFolderPathW

ole32

CoInitialize
CoTaskMemFree
CoCreateInstance
CoUninitialize

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24.5MB - Virtual size: 24.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 13B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 201KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eb210b7c2029319a5e610deeb626e85f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ws2_32

rpcrt4

shell32

ole32

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 24.5MB - Virtual size: 24.5MB

.data Size: 27KB - Virtual size: 48KB

.pdata Size: 72KB - Virtual size: 72KB

.tls Size: 512B - Virtual size: 13B

.gfids Size: 3KB - Virtual size: 2KB

.rsrc Size: 201KB - Virtual size: 200KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 24.5MB - Virtual size: 24.5MB

.data
Size: 27KB - Virtual size: 48KB

.pdata
Size: 72KB - Virtual size: 72KB

.tls
Size: 512B - Virtual size: 13B

.gfids
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 201KB - Virtual size: 200KB

.reloc
Size: 9KB - Virtual size: 9KB