General

Malware Config

Signatures

Files

• 2024-07-05_53472d3da2496ffc50cc33af6b2dbc5d_cobalt-strike_ryuk

  .exe windows:5 windows x64 arch:x64

  0f4efc76589543376ff6b438eff04d55

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  CloseHandle

  CreateFileW

  DeleteCriticalSection

  DeleteFileW

  EncodePointer

  EnterCriticalSection

  EnumSystemLocalesW

  ExitProcess

  FindClose

  FindFirstFileExW

  FindNextFileW

  FlsAlloc

  FlsFree

  FlsGetValue

  FlsSetValue

  FlushFileBuffers

  FreeEnvironmentStringsW

  FreeLibrary

  GetACP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetConsoleMode

  GetConsoleOutputCP

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThreadId

  GetEnvironmentStringsW

  GetFileType

  GetLastError

  GetLocaleInfoW

  GetModuleFileNameW

  GetModuleHandleExW

  GetModuleHandleW

  GetOEMCP

  GetProcAddress

  GetProcessHeap

  GetStartupInfoW

  GetStdHandle

  GetStringTypeW

  GetSystemTimeAsFileTime

  GetUserDefaultLCID

  HeapAlloc

  HeapCreate

  HeapDestroy

  HeapFree

  HeapReAlloc

  HeapSize

  InitializeCriticalSection

  InitializeCriticalSectionAndSpinCount

  InitializeSListHead

  IsDebuggerPresent

  IsProcessorFeaturePresent

  IsValidCodePage

  IsValidLocale

  LCMapStringW

  LeaveCriticalSection

  LoadLibraryExW

  LoadLibraryW

  MulDiv

  MultiByteToWideChar

  QueryPerformanceCounter

  RaiseException

  ReadConsoleW

  ReadFile

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlPcToFileHeader

  RtlUnwindEx

  RtlVirtualUnwind

  SetFilePointerEx

  SetLastError

  SetStdHandle

  SetUnhandledExceptionFilter

  Sleep

  TerminateProcess

  TlsAlloc

  TlsFree

  TlsGetValue

  TlsSetValue

  UnhandledExceptionFilter

  WideCharToMultiByte

  WriteConsoleW

  WriteFile

  gdi32

  BitBlt

  CreateCompatibleBitmap

  CreateCompatibleDC

  CreateDCW

  CreateDIBSection

  CreateFontIndirectW

  CreateRectRgnIndirect

  CreateSolidBrush

  DeleteDC

  DeleteObject

  ExtSelectClipRgn

  GetClipRgn

  GetDIBits

  GetDeviceCaps

  GetObjectA

  GetObjectType

  GetObjectW

  GetStockObject

  SelectClipRgn

  SelectObject

  user32

  AdjustWindowRectEx

  BeginPaint

  CallWindowProcW

  ChildWindowFromPointEx

  ClipCursor

  CreateAcceleratorTableW

  CreateWindowExW

  DefFrameProcW

  DefWindowProcW

  DestroyAcceleratorTable

  DestroyIcon

  DestroyMenu

  DestroyWindow

  DispatchMessageW

  DrawFocusRect

  DrawStateW

  EndPaint

  EnumChildWindows

  FillRect

  GetActiveWindow

  GetCapture

  GetClassNameW

  GetClientRect

  GetCursorPos

  GetDC

  GetFocus

  GetKeyState

  GetMessagePos

  GetMessageW

  GetParent

  GetPropW

  GetSystemMetrics

  GetWindow

  GetWindowLongPtrW

  GetWindowRect

  GetWindowThreadProcessId

  IsChild

  IsWindowEnabled

  IsWindowVisible

  LoadCursorW

  LoadIconW

  MapWindowPoints

  MsgWaitForMultipleObjects

  PeekMessageW

  PostMessageW

  RedrawWindow

  RegisterClassExW

  RegisterClassW

  RegisterWindowMessageW

  ReleaseCapture

  ReleaseDC

  RemovePropW

  ScreenToClient

  SendMessageW

  SetActiveWindow

  SetCapture

  SetCursor

  SetFocus

  SetForegroundWindow

  SetMenu

  SetPropW

  SetRect

  SetWindowLongPtrW

  SetWindowPos

  ShowWindow

  SystemParametersInfoW

  TrackPopupMenu

  TranslateAcceleratorW

  TranslateMessage

  UnregisterClassW

  UpdateWindow

  comctl32

  InitCommonControlsEx

  _TrackMouseEvent

  ole32

  OleInitialize

  OleUninitialize

  RevokeDragDrop

  gdiplus

  GdipAddPathLine

  GdipAlloc

  GdipCloneBrush

  GdipCloneStringFormat

  GdipClosePathFigure

  GdipCreateFont

  GdipCreateFontFromDC

  GdipCreateFontFromLogfontA

  GdipCreateFromHDC

  GdipCreateLineBrush

  GdipCreateMatrix

  GdipCreatePath

  GdipCreatePen1

  GdipCreateSolidFill

  GdipDeleteBrush

  GdipDeleteFont

  GdipDeleteFontFamily

  GdipDeleteGraphics

  GdipDeleteMatrix

  GdipDeletePath

  GdipDeletePen

  GdipDeleteStringFormat

  GdipFillPath

  GdipFree

  GdipGetDpiX

  GdipGetDpiY

  GdipGetFamily

  GdipGetFontSize

  GdipGetFontStyle

  GdipGetLinePresetBlend

  GdipGetLinePresetBlendCount

  GdipGetPathGradientPresetBlend

  GdipGetPathGradientPresetBlendCount

  GdipGetStringFormatFlags

  GdipMultiplyLineTransform

  GdipResetPath

  GdipScaleMatrix

  GdipSetCompositingMode

  GdipSetInterpolationMode

  GdipSetLinePresetBlend

  GdipSetPageUnit

  GdipSetPathFillMode

  GdipSetPathGradientPresetBlend

  GdipSetPenBrushFill

  GdipSetSmoothingMode

  GdipSetStringFormatFlags

  GdipSetTextRenderingHint

  GdipStartPathFigure

  GdipStringFormatGetGenericTypographic

  GdipTranslateWorldTransform

  GdiplusStartup

  shell32

  Shell_NotifyIconW

  Sections

  .text

  Size: 166KB - Virtual size: 165KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 67KB - Virtual size: 67KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 8KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .code

  Size: 1024B - Virtual size: 795B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .gxfg

  Size: 7KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  _RDATA

  Size: 512B - Virtual size: 348B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ