ec50cb208b4e464ee0d09204a6329fd4ce867dc02911e24b9c15930928fc4acd | Triage

Sharing

General

Target

2024-04-22_fa5b700dd378b580e395dc71da2ca812_ponmocup_ryuk
Size

15.4MB
Sample

240422-b3n5ksdg75
MD5

fa5b700dd378b580e395dc71da2ca812
SHA1

84ea39494d25f7a724546a49abfe5b2eacfb8b6e
SHA256

ec50cb208b4e464ee0d09204a6329fd4ce867dc02911e24b9c15930928fc4acd
SHA512

6a4f645a816d19d9acd2892a19399f81797626069c7607f1227725ee9a089384662d685291e837c64f678c4550fa5eda04eec3ad80144125a1f2f93c0d394a96
SSDEEP

393216:Vl4DDxi9c5hlER35ShR4uw22WmfDZHZTtN3ZWAgiQx6w/:b4XxOEhkpQ2z7/tN34QO

Score

7^/10

pyinstaller

Malware Config

Targets

- Target
  
  2024-04-22_fa5b700dd378b580e395dc71da2ca812_ponmocup_ryuk
- Size
  
  15.4MB
- MD5
  
  fa5b700dd378b580e395dc71da2ca812
- SHA1
  
  84ea39494d25f7a724546a49abfe5b2eacfb8b6e
- SHA256
  
  ec50cb208b4e464ee0d09204a6329fd4ce867dc02911e24b9c15930928fc4acd
- SHA512
  
  6a4f645a816d19d9acd2892a19399f81797626069c7607f1227725ee9a089384662d685291e837c64f678c4550fa5eda04eec3ad80144125a1f2f93c0d394a96
- SSDEEP
  
  393216:Vl4DDxi9c5hlER35ShR4uw22WmfDZHZTtN3ZWAgiQx6w/:b4XxOEhkpQ2z7/tN34QO
Score

7^/10
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2