Overview

overview

7

Static

static

3

2024-04-28...uk.exe

windows7-x64

1

2024-04-28...uk.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-04-28_55c81a0e8d0ce1077f061b2069e91aa8_ryuk

  • Size

    1.7MB

  • Sample

    240428-d4318sfb69

  • MD5

    55c81a0e8d0ce1077f061b2069e91aa8

  • SHA1

    f0ade6672b0f6c50aa284a8e5910447338469419

  • SHA256

    55621b111ed8cf69b2506cdaab98598d4d72c882ca4ca407d0445f3568f694be

  • SHA512

    ea31cb87651410ab91019a0dc9c6647de5dcee413be69d6b5ab65911ff3a978423921b5feb18bff52e188648b1be204895b67dbf06d91e716b931e6ebda9c6e6

  • SSDEEP

    24576:gRAugMDUvC+ksSsqjnhMgeiCl7G0nehbGZpbD:QJUK+pWDmg27RnWGj

Score
7/10
persistencespywarestealer

Malware Config

Targets

    • Target

      2024-04-28_55c81a0e8d0ce1077f061b2069e91aa8_ryuk

    • Size

      1.7MB

    • MD5

      55c81a0e8d0ce1077f061b2069e91aa8

    • SHA1

      f0ade6672b0f6c50aa284a8e5910447338469419

    • SHA256

      55621b111ed8cf69b2506cdaab98598d4d72c882ca4ca407d0445f3568f694be

    • SHA512

      ea31cb87651410ab91019a0dc9c6647de5dcee413be69d6b5ab65911ff3a978423921b5feb18bff52e188648b1be204895b67dbf06d91e716b931e6ebda9c6e6

    • SSDEEP

      24576:gRAugMDUvC+ksSsqjnhMgeiCl7G0nehbGZpbD:QJUK+pWDmg27RnWGj

    Score
    7/10
    persistencespywarestealer

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Registers COM server for autorun

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks