a89b781b1a5ed7ce2e0a76b618ef7fe58a803e1159d9348e890cbb096d50c4f9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-06_8f5598f81e2ce6718647d46f17169f17_ryuk
Size

5.5MB
Sample

240606-yzd7jace56
MD5

8f5598f81e2ce6718647d46f17169f17
SHA1

027df6465b0d5ed57dbe320b0067b82d1b0f9d03
SHA256

a89b781b1a5ed7ce2e0a76b618ef7fe58a803e1159d9348e890cbb096d50c4f9
SHA512

26685b1aad10be860730cc73705ae6b54d4cea85f282d912d5362c7bb87f5975250dd245aca6c72eb95c897029620e4feb0567f47170d99ed7ddace6b753e58d
SSDEEP

49152:FEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1Ln9tJEUxDG0BYYrLA50IHLGfE:ZAI5pAdVJn9tbnR1VgBVm+nlS

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  2024-06-06_8f5598f81e2ce6718647d46f17169f17_ryuk
- Size
  
  5.5MB
- MD5
  
  8f5598f81e2ce6718647d46f17169f17
- SHA1
  
  027df6465b0d5ed57dbe320b0067b82d1b0f9d03
- SHA256
  
  a89b781b1a5ed7ce2e0a76b618ef7fe58a803e1159d9348e890cbb096d50c4f9
- SHA512
  
  26685b1aad10be860730cc73705ae6b54d4cea85f282d912d5362c7bb87f5975250dd245aca6c72eb95c897029620e4feb0567f47170d99ed7ddace6b753e58d
- SSDEEP
  
  49152:FEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1Ln9tJEUxDG0BYYrLA50IHLGfE:ZAI5pAdVJn9tbnR1VgBVm+nlS
Score

7^/10

spyware stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2