2024-11-07_0162640367eca24526d3d22b3f8bd298_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2024-11-07_0162640367eca24526d3d22b3f8bd298_ryuk
Size 42.0MB
Sample241107-b6fbvashpk
SHA256 a22f5589b9296498fa243beb41c22cb372937045c756e42825e80a643ef34edc
MD5 0162640367eca24526d3d22b3f8bd298
SHA1 1f4f63f4b0dbf030640b9854896a5205906d87bb
SHA512 9e334cbd7f111362c3104241c19edbe37e3bf32d921ddc5f00b4529011070c15d39bc12a8155fe0c1d4e398471d093c46ca88fcfa0fe1f7ada7d3b18f6b571ef
SSDEEP 786432:hJCI65Ae0YFmmXvYCd5x0sEOXFsl3wEhAG7jSP7R:uI65DdmmXvN4OXFs3hAcST
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-11-07_0162640367eca24526d3d22b3f8bd298_ryuk

File Explorer

2024-11-07_0162640367eca24526d3d22b3f8bd298_ryuk

.exe 42.0MB

2024-11-07_0162640367eca24526d3d22b3f8bd298_ryuk

IMPHASH 1ae8d38c81b3cc895baac49e3c2c55d3
SHA256 a22f5589b9296498fa243beb41c22cb372937045c756e42825e80a643ef34edc
MD5 0162640367eca24526d3d22b3f8bd298
SHA1 1f4f63f4b0dbf030640b9854896a5205906d87bb
SHA512 9e334cbd7f111362c3104241c19edbe37e3bf32d921ddc5f00b4529011070c15d39bc12a8155fe0c1d4e398471d093c46ca88fcfa0fe1f7ada7d3b18f6b571ef
SSDEEP 786432:hJCI65Ae0YFmmXvYCd5x0sEOXFsl3wEhAG7jSP7R:uI65DdmmXvN4OXFs3hAcST
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11461004

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetModuleHandleW K32EnumProcesses LoadLibraryW Process32FirstW Process32NextW CreateToolhelp32Snapshot ResetEvent GetSystemInfo SetEvent CreateEventW CreateFileW WriteFile CloseHandle GetSystemWow64DirectoryW GetSystemDirectoryW WaitForSingleObject GetProcAddress GetModuleHandleA HeapSize WriteConsoleW GetProcessHeap SetEnvironmentVariableW GetOEMCP GetACP IsValidCodePage GetFileSizeEx EnumSystemLocalesW IsValidLocale HeapReAlloc GetLastError ReadFileEx WriteFileEx SetLastError DeviceIoControl CancelIoEx SleepEx Sleep ClearCommBreak ClearCommError EscapeCommFunction GetCommModemStatus GetCommState GetCommTimeouts SetCommBreak SetCommMask SetCommState SetCommTimeouts RaiseException FileTimeToSystemTime LocalAlloc LocalFree FormatMessageW GetCurrentThreadId WTSGetActiveConsoleSessionId ExpandEnvironmentStringsW CreateProcessW CheckRemoteDebuggerPresent OpenProcess GlobalAlloc GlobalUnlock GlobalLock GetLocaleInfoW LoadLibraryA GlobalSize GetCurrentProcessId GetUserDefaultLangID ReadFile SetFilePointer CreateFileMappingW MapViewOfFile UnmapViewOfFile WideCharToMultiByte GetConsoleWindow ExitProcess InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetTimeZoneInformation VirtualAlloc VirtualProtect VirtualFree RtlAddFunctionTable RtlDeleteFunctionTable DisconnectNamedPipe WaitNamedPipeW WaitForMultipleObjects GlobalFree SetHandleInformation GetStdHandle GetEnvironmentStringsW FreeEnvironmentStringsW DuplicateHandle ConnectNamedPipe CreateNamedPipeW WaitForSingleObjectEx GetCurrentProcess TerminateProcess GetExitCodeProcess OutputDebugStringW IsProcessorFeaturePresent SwitchToThread CreateThread GetCurrentThread SetThreadPriority GetThreadPriority TerminateThread ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringEx GetSystemTime GetLocalTime GetCommandLineW QueryPerformanceCounter QueryPerformanceFrequency GetTickCount64 GetDateFormatW GetTimeFormatW GetCurrencyFormatW GetUserDefaultLCID GetUserPreferredUILanguages GetFileAttributesExW PeekNamedPipe UnregisterWaitEx RegisterWaitForSingleObject FlushFileBuffers GetFileType GetLogicalDrives SetEndOfFile SetFilePointerEx SetErrorMode GetCurrentDirectoryW CreateDirectoryW DeleteFileW FindClose FindFirstFileW GetFileAttributesW GetFileInformationByHandle GetFullPathNameW GetLongPathNameW RemoveDirectoryW SetFileTime GetTempPathW GetVolumePathNamesForVolumeNameW CopyFileW MoveFileW MoveFileExW TzSpecificLocalTimeToSystemTime SystemTimeToFileTime GetFileInformationByHandleEx GetStartupInfoW GetModuleFileNameW FreeLibrary GetModuleHandleExW MultiByteToWideChar FindFirstFileExW FindNextFileW GetGeoInfoW GetUserGeoID ReleaseMutex CreateMutexW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime InitializeSListHead EncodePointer DecodePointer RtlPcToFileHeader InitializeCriticalSectionAndSpinCount CompareStringW LCMapStringW GetStringTypeW GetCPInfo RtlUnwindEx LoadLibraryExW ExitThread FreeLibraryAndExitThread GetCommandLineA SetStdHandle GetConsoleMode ReadConsoleW GetConsoleOutputCP SetFileAttributesW HeapAlloc HeapFree

user32

IsTouchWindow GetCapture SetCapture ReleaseCapture GetSystemMetrics GetSystemMenu EnableMenuItem GetForegroundWindow SetForegroundWindow GetDC ReleaseDC BeginPaint EndPaint GetUpdateRect SetWindowRgn InvalidateRect SetWindowTextW GetClientRect GetWindowRect AdjustWindowRectEx SetCursor ClientToScreen ScreenToClient GetWindowLongW SetWindowLongW GetWindowLongPtrW SetWindowLongPtrW GetParent SetParent GetWindowThreadProcessId GetWindow DestroyCursor DestroyIcon MonitorFromPoint GetAncestor GetKeyboardLayoutList RegisterPowerSettingNotification UnregisterPowerSettingNotification UnregisterClassW GetClassInfoW RegisterClassExW GetFocus GetCursorPos WindowFromPoint ChildWindowFromPointEx GetSysColorBrush LoadImageW SetMenu DrawMenuBar CreateMenu CreatePopupMenu DestroyMenu InsertMenuW UnregisterTouchWindow ModifyMenuW RemoveMenu TrackPopupMenu GetMenuItemInfoW RegisterTouchWindow MonitorFromWindow GetMonitorInfoW EnumDisplayMonitors GetSysColor LoadIconW IsHungAppWindow SetClipboardViewer ChangeClipboardChain RegisterClipboardFormatW GetKeyboardLayout RegisterWindowMessageW IsWindowEnabled CreateCaret DestroyCaret HideCaret ShowCaret SetCaretPos FindWindowA PeekMessageW IsZoomed GetKeyState GetKeyboardState ToAscii ToUnicode MapVirtualKeyW GetMenu TrackPopupMenuEx SetCursorPos GetCursor LoadCursorW CreateCursor CreateIconIndirect GetIconInfo GetCursorInfo RegisterClassW EnumDisplayDevicesW GetClipboardFormatNameW TrackMouseEvent GetMessageExtraInfo GetAsyncKeyState GetTouchInputInfo CloseTouchInputHandle GetWindowTextW EnumWindows RealGetWindowClassW ChangeWindowMessageFilterEx DrawIconEx PostThreadMessageW TranslateMessage DispatchMessageW GetQueueStatus MsgWaitForMultipleObjectsEx SetTimer KillTimer SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx CharNextExA SetFocus IsIconic IsWindowVisible SetWindowPlacement GetWindowPlacement SetWindowPos MoveWindow FlashWindowEx MessageBoxW SetLayeredWindowAttributes UpdateLayeredWindow ShowWindow DestroyWindow IsChild CreateWindowExW DefWindowProcW AttachThreadInput PostMessageW SendMessageW UpdateLayeredWindowIndirect SystemParametersInfoW GetDesktopWindow GetCaretBlinkTime MessageBeep IsWindow SetMenuItemInfoW GetDoubleClickTime AppendMenuW

shell32

Shell_NotifyIconW Shell_NotifyIconGetRect ord155 SHParseDisplayName SHGetKnownFolderPath SHBrowseForFolderW ShellExecuteExW SHGetFileInfoW SHGetStockIconInfo ord727 ShellExecuteW SHCreateItemFromIDList SHCreateItemFromParsingName SHGetMalloc SHGetPathFromIDListW CommandLineToArgvW SHGetKnownFolderIDList

setupapi

CM_Get_Parent SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiOpenDevRegKey SetupDiGetDeviceRegistryPropertyW CM_Get_Device_IDW SetupDiEnumDeviceInfo CM_Get_DevNode_Status

api-ms-win-core-winrt-l1-1-0

RoActivateInstance RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

d3d12

D3D12SerializeRootSignature ord102 ord101

d3dcompiler_47

D3DCompile D3DReflect

dcomp

DCompositionCreateDevice

dwmapi

DwmIsCompositionEnabled DwmEnableBlurBehindWindow

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1 CreateDXGIFactory2

imm32

ImmSetCandidateWindow ImmGetContext ImmReleaseContext ImmAssociateContext ImmAssociateContextEx ImmGetCompositionStringW ImmGetOpenStatus ImmNotifyIME ImmGetVirtualKey ImmGetDefaultIMEWnd ImmSetCompositionWindow

opengl32

glOrtho glMatrixMode glLoadMatrixf glLoadIdentity

iphlpapi

ConvertInterfaceLuidToIndex ConvertInterfaceLuidToNameW GetAdaptersAddresses ConvertInterfaceLuidToGuid ConvertInterfaceIndexToLuid ConvertInterfaceNameToLuidW

userenv

GetUserProfileDirectoryW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

netapi32

NetShareEnum NetApiBufferFree

ws2_32

WSAHtonl htonl ntohl getaddrinfo WSAAsyncSelect WSACleanup WSAStartup gethostname WSASocketW WSASendTo WSASend WSARecvFrom WSARecv WSANtohs WSANtohl WSAIoctl select WSAConnect WSAAccept WSAGetLastError setsockopt freeaddrinfo getnameinfo getsockopt __WSAFDIsSet bind closesocket getpeername getsockname htons listen

winmm

timeKillEvent timeSetEvent PlaySoundW

gdi32

GetPixelFormat DescribePixelFormat ChoosePixelFormat CreateBitmap SelectObject DeleteDC SetPixelFormat CreateCompatibleDC CreateCompatibleBitmap GetDeviceCaps SetLayout SelectClipRgn OffsetRgn SwapBuffers CreateDCW GetBitmapBits DeleteObject CreateRectRgn CombineRgn GetCharABCWidthsI GetDIBits ExtTextOutW SetWorldTransform SetTextAlign SetTextColor SetGraphicsMode SetBkMode BitBlt GetObjectW CreateFontIndirectW EnumFontFamiliesExW GetFontData GetStockObject AddFontResourceExW RemoveFontResourceExW AddFontMemResourceEx RemoveFontMemResourceEx GetTextMetricsW GetTextFaceW CreateDIBSection GetTextExtentPoint32W GetOutlineTextMetricsW GetGlyphOutlineW GetCharABCWidthsFloatW GetCharABCWidthsW GdiFlush

advapi32

RegDeleteValueW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegNotifyChangeKeyValue SystemFunction036 OpenProcessToken AccessCheck AllocateAndInitializeSid CopySid DuplicateToken FreeSid GetLengthSid GetTokenInformation MapGenericMask LookupAccountSidW GetEffectiveRightsFromAclW GetNamedSecurityInfoW BuildTrusteeWithSidW RegCreateKeyExW RegSetValueExW RegQueryInfoKeyW RegFlushKey RegEnumKeyExW RegCloseKey RegDeleteKeyW

ole32

RevokeDragDrop OleInitialize OleUninitialize CoInitialize OleSetClipboard OleGetClipboard OleFlushClipboard OleIsCurrentClipboard CoCreateInstance DoDragDrop CoTaskMemFree ReleaseStgMedium CoGetMalloc CoCreateGuid RegisterDragDrop CoInitializeEx CoUninitialize CoLockObjectExternal

oleaut32

SafeArrayPutElement SafeArrayCreateVector SysAllocString

Name

.text

Size

11.2MB

Virtual Size

11.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

29.6MB

Virtual Size

29.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

235KB

Virtual Size

322KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

629KB

Virtual Size

629KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.qtmetad

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

13B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

608B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1024B

Virtual Size

528B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gehcont

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

201KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=27, id=259, version=27412,

count=1, id=199, version=41118,

count=14, id=259, version=24123,

count=67, id=261, version=24123,

count=39, id=260, version=24123,

count=196, id=261, version=27412,

count=234, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1465, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=62, id=260, version=27412,

count=1, id=262, version=27412,

count=47, id=257, version=27412,

count=548, id=1, productName=Unmarked objects,

count=8, id=265, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,