Overview

overview

10

Static

static

10

2024-06-07...uk.exe

windows7-x64

7

2024-06-07...uk.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2024-06-07_687220a9fca3a2582e102f3e2fcb1688_ryuk

  • Size

    10.3MB

  • MD5

    687220a9fca3a2582e102f3e2fcb1688

  • SHA1

    3eaec826f084c2650e1213f13860bb253fe9fde6

  • SHA256

    be3d50fede3068ef0a880b1fd951756c8bfc30f63063a4fa2a627275f717febf

  • SHA512

    451d2c8128c847d67c6d1c1802d6e1daa70513affa45af6e0516d4406324481f4b9e1e674a08c100ef750da2d897e7e291a7ace6ddf9870389777b0ee98ff1a3

  • SSDEEP

    196608:YSg+GIxPQOz7z9onJ5hrZERlyiU8AdZYJERY48RmU/3ZlsPvZN4rT72ED8CAc3Dv:rP5l7z9c5hlERJAdZYyGtN3ZW8rnUc3r

Score
10/10
pyinstallercobaltstrike

Malware Config

Extracted

Family

cobaltstrike

C2

http://192.168.0.102:80/4Kjt

Attributes
  • user_agent

    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2; .NET4.0C; .NET4.0E)

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2024-06-07_687220a9fca3a2582e102f3e2fcb1688_ryuk
    .exe windows:5 windows x64 arch:x64

    58053a2a3020fdc7713b576ad93bf7bd


    Headers

    Imports

    Sections

  • shellcodeCreateNew.pyc