2024-10-14_2e2237cc43c39b5ed37d52daa7a0c72b_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-10-14_2e2237cc43c39b5ed37d52daa7a0c72b_ryuk
Size

17.1MB
MD5

2e2237cc43c39b5ed37d52daa7a0c72b
SHA1

a0e8af584c67cf5ed86e7e391f4f807faa88c360
SHA256

7a17258101d91dfb633f763c721742e1aa0cb2b54a8ff00e878727ea6b90a418
SHA512

2e831fb31f1a01221623c69f1cf5724d218eefff32571a8171f6d0083910e8065826b981dbd71359dfadc8a63aa47d3e4ec63e7e418986c72ef9d3f38b68b487
SSDEEP

393216:TpCJsv6tWKFdu9CNuCbGFaWBxWrm//GKZF7zEOT7sBGNtWQWN/as0r2e71Mz:TCGFD7t//GKZF7QqXWN/2rRZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-10-14_2e2237cc43c39b5ed37d52daa7a0c72b_ryuk

Files

2024-10-14_2e2237cc43c39b5ed37d52daa7a0c72b_ryuk
.exe windows:6 windows x64 arch:x64

bf4ffefb089f36690e6565f42a1db313

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetModuleHandleW
GetProcAddress
LoadLibraryW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
K32EnumProcessModules
K32EnumProcesses
K32GetModuleBaseNameW
OpenProcess
GetConsoleWindow
LocalFree
GetWindowsDirectoryW
CreateThread
CloseHandle
GetLastError
GetSystemWow64DirectoryW
LocalAlloc
WaitForSingleObject
CreateDirectoryW
HeapSize
FindNextFileA
FindFirstFileExA
GetProcessHeap
OutputDebugStringW
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
CompareStringEx
GetCommandLineW
GetCurrentProcessId
FormatMessageW
SetEvent
WaitForSingleObjectEx
CreateEventW
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount64
GetSystemTime
GetLocalTime
DuplicateHandle
Sleep
WaitForMultipleObjects
SwitchToThread
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
GetThreadPriority
TerminateThread
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemInfo
CreateFileW
GetFileAttributesExW
GetCurrentDirectoryW
DeleteFileW
FindClose
FindFirstFileW
GetFileAttributesW
GetFileInformationByHandle
GetFullPathNameW
GetLogicalDrives
GetLongPathNameW
RemoveDirectoryW
SetFileTime
GetTempPathW
GetVolumePathNamesForVolumeNameW
SetErrorMode
DeviceIoControl
CopyFileW
MoveFileW
MoveFileExW
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
GetFileInformationByHandleEx
FlushFileBuffers
GetFileType
ReadFile
SetEndOfFile
SetFilePointerEx
WriteFile
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetStdHandle
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetFilePointer
ConnectNamedPipe
CreateNamedPipeW
GetExitCodeProcess
CreateProcessW
GetProcessId
UnregisterWaitEx
RegisterWaitForSingleObject
GetStartupInfoW
GetModuleFileNameW
ResetEvent
MultiByteToWideChar
WideCharToMultiByte
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
GetCurrencyFormatW
GetUserDefaultLCID
GetUserPreferredUILanguages
FindFirstFileExW
FindNextFileW
ReadFileEx
PeekNamedPipe
CancelIoEx
SleepEx
WriteFileEx
GetSystemDirectoryW
GetTimeZoneInformation
GetGeoInfoW
GetUserGeoID
FreeLibrary
GetModuleHandleExW
LoadLibraryA
ReleaseMutex
CreateMutexW
VirtualAlloc
VirtualFree
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetTickCount
RtlPcToFileHeader
RaiseException
CompareStringW
LCMapStringW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
RtlUnwindEx
GetCommandLineA
ExitThread
GetConsoleMode
ReadConsoleW
GetConsoleCP
SetFileAttributesW
SetStdHandle
HeapAlloc
HeapFree
HeapReAlloc
ExitProcess
GetModuleFileNameA
GetACP
IsValidLocale
EnumSystemLocalesW
SetEnvironmentVariableA
SetEnvironmentVariableW
IsValidCodePage
GetOEMCP
WriteConsoleW

user32

DefWindowProcW
RegisterClassW
UnregisterClassW
CreateWindowExW
DestroyWindow
GetQueueStatus
MsgWaitForMultipleObjectsEx
SetTimer
KillTimer
PeekMessageW
SetWindowLongPtrW
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
CharNextExA
PostMessageW
MessageBoxW
ShowWindow
DispatchMessageW
PostThreadMessageW
TranslateMessage
GetWindowThreadProcessId
GetWindowLongPtrW
EnumWindows

advapi32

SetEntriesInAclW
RegOpenKeyExW
RegQueryValueExW
OpenProcessToken
AccessCheck
AllocateAndInitializeSid
CopySid
DuplicateToken
FreeSid
GetLengthSid
GetTokenInformation
MapGenericMask
LookupAccountSidW
GetEffectiveRightsFromAclW
GetNamedSecurityInfoW
BuildTrusteeWithSidW
SystemFunction036
RegEnumKeyExW
RegQueryInfoKeyW
RegCreateKeyExW
RegDeleteKeyW
GetSidSubAuthorityCount
GetSidSubAuthority
RegSetValueExW
InitializeSecurityDescriptor
SetNamedSecurityInfoW
RegCloseKey
SetSecurityDescriptorDacl
RegFlushKey
RegEnumValueW
RegDeleteValueW

userenv

GetUserProfileDirectoryW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

netapi32

NetApiBufferFree
NetShareEnum

ws2_32

WSAAsyncSelect

winmm

timeKillEvent
timeSetEvent

winhttp

WinHttpReadData
WinHttpCloseHandle
WinHttpCrackUrl
WinHttpOpen
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpConnect
WinHttpOpenRequest

rpcrt4

RpcStringFreeA
UuidToStringA
UuidCreate

ole32

CoTaskMemFree
CoInitialize
CoUninitialize
CoCreateInstance

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15.1MB - Virtual size: 15.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 13B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 201KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bf4ffefb089f36690e6565f42a1db313

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

userenv

version

netapi32

ws2_32

winmm

winhttp

rpcrt4

ole32

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 15.1MB - Virtual size: 15.1MB

.data Size: 25KB - Virtual size: 49KB

.pdata Size: 86KB - Virtual size: 85KB

.tls Size: 512B - Virtual size: 13B

.gfids Size: 3KB - Virtual size: 2KB

.rsrc Size: 201KB - Virtual size: 200KB

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 15.1MB - Virtual size: 15.1MB

.data
Size: 25KB - Virtual size: 49KB

.pdata
Size: 86KB - Virtual size: 85KB

.tls
Size: 512B - Virtual size: 13B

.gfids
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 201KB - Virtual size: 200KB

.reloc
Size: 9KB - Virtual size: 8KB