2025-03-20_89638b8691bbabd7b3ff93c64612c8fa_ryuk

General

Target
2025-03-20_89638b8691bbabd7b3ff93c64612c8fa_ryuk
Size 139KB
Sample250320-b4grwstmx7
SHA256 5d3d9b6382e76ef0385c275bff4cb58893befc6e5289e9023eace844ce87119f
MD5 89638b8691bbabd7b3ff93c64612c8fa
SHA1 1301e3b4efe398c067e0696a3db41f962c7e4593
SHA512 125d57166c5f9a153f55c457142ae96ea258da10c1b3374059ef6d3b0868b3bfe6ff77b969f9d6b338eb7aff14634115a9a41940b504c3a0dc265388419cfcdd
SSDEEP 3072:aiVBxBxlij/H9qU4j5rbZwpfHUSBMB/x8LMj4bfq:fVB1Yj/8vj5/iTM5x8wjyf
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-03-20_89638b8691bbabd7b3ff93c64612c8fa_ryuk

File Explorer

2025-03-20_89638b8691bbabd7b3ff93c64612c8fa_ryuk

.exe 139KB

2025-03-20_89638b8691bbabd7b3ff93c64612c8fa_ryuk

IMPHASH 8c8bbc003f86b962e3d95c972e631580
SHA256 5d3d9b6382e76ef0385c275bff4cb58893befc6e5289e9023eace844ce87119f
MD5 89638b8691bbabd7b3ff93c64612c8fa
SHA1 1301e3b4efe398c067e0696a3db41f962c7e4593
SHA512 125d57166c5f9a153f55c457142ae96ea258da10c1b3374059ef6d3b0868b3bfe6ff77b969f9d6b338eb7aff14634115a9a41940b504c3a0dc265388419cfcdd
SSDEEP 3072:aiVBxBxlij/H9qU4j5rbZwpfHUSBMB/x8LMj4bfq:fVB1Yj/8vj5/iTM5x8wjyf
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

55827

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentProcess CreateThread GetCurrentThread SetLastError WaitForMultipleObjects Sleep WinExec GetLocalTime GetTickCount LoadLibraryA GetSystemDirectoryA CloseHandle GetProcAddress CreateFileW DecodePointer WriteConsoleW SetFilePointerEx QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW TerminateProcess RtlUnwind GetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte GetACP HeapFree HeapAlloc GetStringTypeW LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode RaiseException

advapi32

CloseServiceHandle

ws2_32

htons htonl bind inet_addr

Sharing

General

Malware Config

Signatures

File Explorer

2025-03-20_89638b8691bbabd7b3ff93c64612c8fa_ryuk

kernel32

advapi32

ws2_32

generic