Static task
static1
Behavioral task
behavioral1
Sample
2024-06-10_68ad063298c6edc71aa099aed560618b_cobalt-strike_ryuk.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-10_68ad063298c6edc71aa099aed560618b_cobalt-strike_ryuk.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-10_68ad063298c6edc71aa099aed560618b_cobalt-strike_ryuk
-
Size
668KB
-
MD5
68ad063298c6edc71aa099aed560618b
-
SHA1
484f37566cf4ba3f649bc90ec3624919f152f757
-
SHA256
cd94cf10d1d10eb06777dafda125225f616f42d9b03be414ad7f181396c33fe2
-
SHA512
d04dea4f1bcba7dd113262dd0c0643d82d2ded88e0c4133c9ac5cf918f6ac2346ccd7c0a2b159da92af72612ad487ee56ae482ba4ab581c3c29837e287792151
-
SSDEEP
12288:ZsKkjx5E70v21B41P/FfwrVytv0kqQHV+R91Hp5MY3yQngCOuHPL3SwM+a+:ux5E7zbtJpTNM+N
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-10_68ad063298c6edc71aa099aed560618b_cobalt-strike_ryuk
Files
-
2024-06-10_68ad063298c6edc71aa099aed560618b_cobalt-strike_ryuk.exe windows:5 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 768KB - Virtual size: 768KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 131KB - Virtual size: 131KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 37KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: 512B - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gxfg Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.retplne Size: 512B - Virtual size: 92B
.tls Size: 512B - Virtual size: 297B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.voltbl Size: 512B - Virtual size: 68B
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ