Overview

overview

7

Static

static

3

2024-05-29...uk.exe

windows7-x64

7

2024-05-29...uk.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-05-29_26e398aa13ba10b87831e40643dde9c4_ryuk

  • Size

    6.1MB

  • Sample

    240529-aq8g1sbf63

  • MD5

    26e398aa13ba10b87831e40643dde9c4

  • SHA1

    c2a311d4c81be8e2c49dfad858b30fcc2129e3c5

  • SHA256

    14a2b3d5b4caabddae226aef59d07e47a323a05fbd0f95ede60b59c43d4a23d2

  • SHA512

    21c2a6ba91f7a874aa5e4a2b78c1fdc6d978c0280b92833a8f593b5ac67f64fe45c9b0cda54369b1540b03d661a1b3caee7b6a4b4435569dcb13894dc5a2fc7a

  • SSDEEP

    196608:atZKD5d9e+q2WWmQNLBBGZlrljNctfg+ieq:0ZCd9vqZQxBBG5jkrL

Score
7/10
pyinstallerspywarestealer

Malware Config

Targets

    • Target

      2024-05-29_26e398aa13ba10b87831e40643dde9c4_ryuk

    • Size

      6.1MB

    • MD5

      26e398aa13ba10b87831e40643dde9c4

    • SHA1

      c2a311d4c81be8e2c49dfad858b30fcc2129e3c5

    • SHA256

      14a2b3d5b4caabddae226aef59d07e47a323a05fbd0f95ede60b59c43d4a23d2

    • SHA512

      21c2a6ba91f7a874aa5e4a2b78c1fdc6d978c0280b92833a8f593b5ac67f64fe45c9b0cda54369b1540b03d661a1b3caee7b6a4b4435569dcb13894dc5a2fc7a

    • SSDEEP

      196608:atZKD5d9e+q2WWmQNLBBGZlrljNctfg+ieq:0ZCd9vqZQxBBG5jkrL

    Score
    7/10
    spywarestealer

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks