6efe49b9ad3afe257a3b32124a53b32c7ef9f429d17ec5dbd95fa26004dd6b68 | Triage

Sharing

General

Target

2024-01-11_dd0509878753c2de10d6ffcfc690b002_ryuk
Size

5.5MB
Sample

240112-gt82aabbe6
MD5

dd0509878753c2de10d6ffcfc690b002
SHA1

f31758ce135439ba1d293c8abd8c54029f9064a4
SHA256

6efe49b9ad3afe257a3b32124a53b32c7ef9f429d17ec5dbd95fa26004dd6b68
SHA512

5654a491152527934a87d98fa54bd73f70cee358a09b2ac44d2b301eac8f7209843b5cfab7dc5b878958a9e442bf1f789fdb88df09c936e645042d4fbc98d5c2
SSDEEP

49152:TEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1bn9tJEUxDG0BYYrLA50IHLGfj:PAI5pAdV9n9tbnR1VgBVmhrvvRe12fD

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  2024-01-11_dd0509878753c2de10d6ffcfc690b002_ryuk
- Size
  
  5.5MB
- MD5
  
  dd0509878753c2de10d6ffcfc690b002
- SHA1
  
  f31758ce135439ba1d293c8abd8c54029f9064a4
- SHA256
  
  6efe49b9ad3afe257a3b32124a53b32c7ef9f429d17ec5dbd95fa26004dd6b68
- SHA512
  
  5654a491152527934a87d98fa54bd73f70cee358a09b2ac44d2b301eac8f7209843b5cfab7dc5b878958a9e442bf1f789fdb88df09c936e645042d4fbc98d5c2
- SSDEEP
  
  49152:TEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1bn9tJEUxDG0BYYrLA50IHLGfj:PAI5pAdV9n9tbnR1VgBVmhrvvRe12fD
Score

7^/10

spyware stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2