2025-07-02_abf0213dc29e2d4a4f1574048d5cf0a0_black-basta_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2025-07-02_abf0213dc29e2d4a4f1574048d5cf0a0_black-basta_ryuk
Size 950KB
Sample250702-e2yjeassdz
SHA256 20750ea2da1c09b4437d66eaa2b633ff3ccf572946f9be888d226f2dc10fc77d
MD5 abf0213dc29e2d4a4f1574048d5cf0a0
SHA1 2031b5df6c62b730c6b0a49fe567021ac61253e3
SHA512 2f9ffbbec8b4e5333b490a03ad99812d8182f7cc9f3552a4e8e2d53488b83fd7683a0e54f3e193281f3662086bfb067a0b740a08d88d7c8ed39e55e691f6d2e7
SSDEEP 12288:V1MKv/gcgZwdVCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCZ:VmGXpdG093z+ZaVWNl328NjOZ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-07-02_abf0213dc29e2d4a4f1574048d5cf0a0_black-basta_ryuk

File Explorer

2025-07-02_abf0213dc29e2d4a4f1574048d5cf0a0_black-basta_ryuk

.exe 950KB

2025-07-02_abf0213dc29e2d4a4f1574048d5cf0a0_black-basta_ryuk

IMPHASH b0565cdccadf19e165e5c9e4185ebe4f
SHA256 20750ea2da1c09b4437d66eaa2b633ff3ccf572946f9be888d226f2dc10fc77d
MD5 abf0213dc29e2d4a4f1574048d5cf0a0
SHA1 2031b5df6c62b730c6b0a49fe567021ac61253e3
SHA512 2f9ffbbec8b4e5333b490a03ad99812d8182f7cc9f3552a4e8e2d53488b83fd7683a0e54f3e193281f3662086bfb067a0b740a08d88d7c8ed39e55e691f6d2e7
SSDEEP 12288:V1MKv/gcgZwdVCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCZ:VmGXpdG093z+ZaVWNl328NjOZ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

103216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ssh-agent.pdb

libcrypto

EVP_sha384 EVP_md5 DSA_SIG_free EVP_sha256 DSA_SIG_new EVP_Digest EVP_sha1 EVP_sha512 EVP_CIPHER_CTX_key_length DSA_do_verify DSA_do_sign EVP_CIPHER_CTX_new EVP_aes_256_cbc ECDSA_SIG_new ECDSA_do_verify ECDSA_SIG_free ECDSA_do_sign EVP_CipherInit EVP_des_ede3_cbc EVP_aes_192_cbc EVP_CIPHER_CTX_set_app_data EVP_CIPHER_CTX_get_app_data AES_set_encrypt_key AES_encrypt EVP_CIPHER_CTX_ctrl EVP_CIPHER_CTX_set_key_length RAND_bytes EVP_aes_256_gcm EVP_aes_128_gcm EVP_CIPHER_CTX_free EC_POINT_oct2point BN_bn2bin EC_POINT_point2oct BN_bin2bn RSA_public_decrypt RSA_sign BN_div RSA_size BN_CTX_new BN_CTX_free RSA_blinding_on BN_dup EC_GROUP_get_order DSA_free BN_clear_free EC_KEY_set_private_key BN_value_one EC_METHOD_get_field_type EC_POINT_mul RSA_new RSA_free ERR_get_error EC_POINT_get_affine_coordinates_GFp EC_KEY_set_public_key BN_free EC_POINT_is_at_infinity EC_POINT_free EVP_aes_128_cbc EC_KEY_free EC_KEY_get0_public_key DSA_new EC_POINT_new BN_new EC_KEY_get0_private_key EC_KEY_get0_group BN_cmp BN_sub EC_GROUP_method_of EC_KEY_new_by_curve_name EVP_Cipher BN_num_bits

kernel32

SetCurrentDirectoryW SetEnvironmentVariableW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError RtlUnwindEx GetModuleHandleW GetStartupInfoW IsDebuggerPresent InitializeSListHead QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCurrentDirectoryW LoadLibraryExW ReadConsoleOutputA SetConsoleCursorPosition GetConsoleWindow Beep FillConsoleOutputAttribute WriteConsoleOutputA SetConsoleCursorInfo SetConsoleWindowInfo GetConsoleCP GetConsoleCursorInfo ScrollConsoleScreenBufferA SetConsoleScreenBufferSize SetConsoleTextAttribute FillConsoleOutputCharacterA GetCommandLineA WriteConsoleW SetConsoleCtrlHandler GetModuleFileNameW GetLastError ExitProcess GetModuleHandleExW FindClose FindFirstFileExW SetHandleInformation FindNextFileW CreateNamedPipeW WaitForMultipleObjects CreateThread GetNamedPipeClientProcessId ExitThread GetQueuedCompletionStatus FreeLibraryAndExitThread OpenProcess HeapFree HeapAlloc SetEvent CloseHandle GetCurrentProcessId CreateProcessW CreateEventA CreateIoCompletionPort ConnectNamedPipe ReadFile WriteFile GetOverlappedResult CompareStringW LCMapStringW LocalFree GetStringTypeW GetCommandLineW SetStdHandle GetConsoleMode GetCurrentProcess GetStdHandle TerminateProcess ReadConsoleW CreateWaitableTimerA SetEndOfFile GetCurrentThreadId SetFilePointerEx GetFileType WaitForSingleObjectEx WaitForMultipleObjectsEx OpenThread FlushFileBuffers HeapReAlloc GetConsoleScreenBufferInfo GetFileSizeEx IsValidCodePage WaitForSingleObject CreateFileW GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW GetProcAddress FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetExitCodeProcess FreeEnvironmentStringsW WriteFileEx CreateFileA SleepEx GetProcessHeap HeapSize RaiseException GetLocalTime QueueUserAPC MultiByteToWideChar

advapi32

StartServiceCtrlDispatcherW EventWrite EventRegister RegDeleteTreeA RevertToSelf RegCloseKey RegOpenCurrentUser RegCreateKeyExA RegDeleteKeyExA RegEnumKeyExW ImpersonateLoggedOnUser RegDeleteTreeW RegOpenKeyExA RegOpenKeyExW RegQueryValueExW CreateWellKnownSid RegCreateKeyExW IsWellKnownSid RegSetValueExW OpenProcessToken CheckTokenMembership DuplicateToken ConvertStringSecurityDescriptorToSecurityDescriptorW GetTokenInformation OpenSCManagerW SetServiceStatus RegisterServiceCtrlHandlerW StartServiceA OpenServiceW

crypt32

CryptProtectData CryptUnprotectData CryptStringToBinaryA

ws2_32

WSAStartup WSAGetLastError WSASend

user32

GetWindowPlacement ShowWindow

Name

.text

Size

191KB

Virtual Size

191KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

171KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2025-07-02_abf0213dc29e2d4a4f1574048d5cf0a0_black-basta_ryuk

libcrypto

kernel32

advapi32

crypt32

ws2_32

user32

generic