2025-03-22_b2a31ff4048cc5c9ec4e5d44e742a94b_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2025-03-22_b2a31ff4048cc5c9ec4e5d44e742a94b_ryuk
Size 905KB
Sample250322-mv5cdavry5
SHA256 acfe65cf08cb8b8239b27d762f68f6602210b686cd88438a24f6c77d8524ff46
MD5 b2a31ff4048cc5c9ec4e5d44e742a94b
SHA1 63892286dd4505971f1c061b70e21c6760bddc47
SHA512 f74ce6a4767503ea1ce8d3f6fba89a9acf25abe3d6e53c2c0acbdba20dc56c834949203dd46ad10a06166912f0cd222b9ae9e3c9db8eb011672d86f17ee69c3f
SSDEEP 12288:CthJIq+H3rw6R59ES7lWtE02rBzhzasvJZlDvRHeplOwFGwhMTSVTPEDSukrEOIe:CX+qS7ZGSL5FxJPp+ewwwh2SZAO
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-03-22_b2a31ff4048cc5c9ec4e5d44e742a94b_ryuk

File Explorer

2025-03-22_b2a31ff4048cc5c9ec4e5d44e742a94b_ryuk

.exe 905KB

2025-03-22_b2a31ff4048cc5c9ec4e5d44e742a94b_ryuk

IMPHASH ae38d001749e4b5f233dc680bc3b0e4b
SHA256 acfe65cf08cb8b8239b27d762f68f6602210b686cd88438a24f6c77d8524ff46
MD5 b2a31ff4048cc5c9ec4e5d44e742a94b
SHA1 63892286dd4505971f1c061b70e21c6760bddc47
SHA512 f74ce6a4767503ea1ce8d3f6fba89a9acf25abe3d6e53c2c0acbdba20dc56c834949203dd46ad10a06166912f0cd222b9ae9e3c9db8eb011672d86f17ee69c3f
SSDEEP 12288:CthJIq+H3rw6R59ES7lWtE02rBzhzasvJZlDvRHeplOwFGwhMTSVTPEDSukrEOIe:CX+qS7ZGSL5FxJPp+ewwwh2SZAO
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

109848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle GetLastError SetLastError SetErrorMode GetThreadErrorMode IsThreadAFiber DeviceIoControl Sleep GetCurrentProcess GetCurrentProcessId ExitProcess SwitchToThread TlsAlloc FlushProcessWriteBuffers FlushInstructionCache GetTickCount GetTickCount64 GetLargePageMinimum GetModuleFileNameA GetModuleFileNameW GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW IsDebuggerPresent GlobalAlloc LocalAlloc LocalFree GetShortPathNameA ConvertFiberToThread IsSystemResumeAutomatic GetSystemDEPPolicy lstrcpyA lstrcatA lstrlenA UnregisterApplicationRestart GetACP GetOEMCP GetThreadLocale GetUserDefaultUILanguage GetThreadUILanguage FreeConsole GetConsoleOutputCP K32QueryWorkingSetEx WriteConsoleW CreateFileW SetFilePointerEx GetConsoleMode GetLogicalDrives GetEnvironmentVariableA GetEnvironmentStringsW LoadLibraryA GetCommandLineW GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize RaiseException GetProcessHeap LCMapStringW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetStartupInfoW RtlUnwindEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleHandleExW HeapFree HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetCPInfo GetCommandLineA MultiByteToWideChar WideCharToMultiByte FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW

user32

FlashWindow GetPropW GetWindowLongW

winspool.drv

GetPrinterDataW GetPrinterDataA

advapi32

GetTokenInformation GetSidSubAuthority OpenProcessToken RegDisablePredefinedCacheEx

shell32

ShellExecuteExW ord680 ShellExecuteA

shlwapi

StrStrA

winmm

timeGetTime

Name

.text

Size

146KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

164B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

712KB

Virtual Size

711KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2025-03-22_b2a31ff4048cc5c9ec4e5d44e742a94b_ryuk

kernel32

user32

winspool.drv

advapi32

shell32

shlwapi

winmm

generic