2024-07-25_9b6915df01b82145ecf93b717df7af85_cobalt-strike_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2024-07-25_9b6915df01b82145ecf93b717df7af85_cobalt-strike_ryuk
Size 224KB
Sample240725-lzdvjsvdph
SHA256 5bea4028b99ab2708fff4512578311052755890acb018d5b65b1455193c7f71e
MD5 9b6915df01b82145ecf93b717df7af85
SHA1 0c788ce9bb0cab7544acb6e6dd09c911354d7204
SHA512 6a9b793f009d8ad43b566f9d444111b74ab53ebf861811dafb39051897608e65a6e245105bf4a1bf4af2545cbf6cb57b8d7289eab377e0fdc3b0729774029786
SSDEEP 3072:2tenit+HYNijlnD5uPEw4EXWq/faB4ymKFYVnXGfbR/k7bY8Juyu/0h4:2rQuij9toE6nfPymKuXGcJWs
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-07-25_9b6915df01b82145ecf93b717df7af85_cobalt-strike_ryuk

File Explorer

2024-07-25_9b6915df01b82145ecf93b717df7af85_cobalt-strike_ryuk

.exe 224KB

2024-07-25_9b6915df01b82145ecf93b717df7af85_cobalt-strike_ryuk

IMPHASH 4c2579b24c5aa5ccd789399e59bdf8a6
SHA256 5bea4028b99ab2708fff4512578311052755890acb018d5b65b1455193c7f71e
MD5 9b6915df01b82145ecf93b717df7af85
SHA1 0c788ce9bb0cab7544acb6e6dd09c911354d7204
SHA512 6a9b793f009d8ad43b566f9d444111b74ab53ebf861811dafb39051897608e65a6e245105bf4a1bf4af2545cbf6cb57b8d7289eab377e0fdc3b0729774029786
SSDEEP 3072:2tenit+HYNijlnD5uPEw4EXWq/faB4ymKFYVnXGfbR/k7bY8Juyu/0h4:2rQuij9toE6nfPymKuXGcJWs
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

33648

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateFileW DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileSizeEx GetFileType GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW MultiByteToWideChar OpenProcess QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualAlloc VirtualQueryEx WaitForSingleObject WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

Name

.text

Size

137KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

140B

Characteristics

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

424B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2024-07-25_9b6915df01b82145ecf93b717df7af85_cobalt-strike_ryuk

kernel32

generic