Overview

overview

10

Static

static

10

2024-06-07...uk.exe

windows7-x64

1

2024-06-07...uk.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2024-06-07_296060397e0a893cb6126dd2ff3761ef_ryuk

  • Size

    10.3MB

  • MD5

    296060397e0a893cb6126dd2ff3761ef

  • SHA1

    ca22631f297f518b7ab51145aa25aa8300dc4307

  • SHA256

    b7d2ef3a940e1d757f9a22044097874e446f42d11ea8456987fd981213322fc6

  • SHA512

    a2dcf57f7a04595abe5c253c401b95027989df7df3746ffb399ab151463e945d6272105ddf2274e8cf81a8a73096fd19476457953324e25fd47d80602df1c7a2

  • SSDEEP

    196608:YST+GIxPQOz7z9onJ5hrZERlyiU8AdZYJERY48RmU/3ZlsPvZN4rT72ED8C0wXx3:2P5l7z9c5hlERJAdZYyGtN3ZW8rnwwB

Score
10/10
pyinstallercobaltstrike

Malware Config

Extracted

Family

cobaltstrike

C2

http://192.168.0.102:80/4Kjt

Attributes
  • user_agent

    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2; .NET4.0C; .NET4.0E)

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2024-06-07_296060397e0a893cb6126dd2ff3761ef_ryuk
    .exe windows:5 windows x64 arch:x64

    58053a2a3020fdc7713b576ad93bf7bd


    Headers

    Imports

    Sections

  • shellcodeCreateNew.pyc