c1805da277febf1ec2e986de1e9f36d5fcc17764a438c9cb2f2c1034f210a397 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-07-26_2a544e39d678d3369f2943a9dc6e81ec_cobalt-strike_ryuk
Size

2.2MB
Sample

240726-mh5sda1glq
MD5

2a544e39d678d3369f2943a9dc6e81ec
SHA1

4465c3b854da1322bf991b20cf18343846f5d3cb
SHA256

c1805da277febf1ec2e986de1e9f36d5fcc17764a438c9cb2f2c1034f210a397
SHA512

0c1dd1c1049ab0b04389845244651fc2d72bd4b4cb5adf4a12285b7296fa29dfd3431319b09b7b20c0d28ff812f30ac3e08d82d214df560562fceacd7dd4f8db
SSDEEP

24576:5OObVw4TaN1wdkukCba4oXtgLhU3wEdmh581cndLxdmo+eXEVT3wvUzO:5OOh3aN4kuLbegmtG+cJrmemTgvC

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  2024-07-26_2a544e39d678d3369f2943a9dc6e81ec_cobalt-strike_ryuk
- Size
  
  2.2MB
- MD5
  
  2a544e39d678d3369f2943a9dc6e81ec
- SHA1
  
  4465c3b854da1322bf991b20cf18343846f5d3cb
- SHA256
  
  c1805da277febf1ec2e986de1e9f36d5fcc17764a438c9cb2f2c1034f210a397
- SHA512
  
  0c1dd1c1049ab0b04389845244651fc2d72bd4b4cb5adf4a12285b7296fa29dfd3431319b09b7b20c0d28ff812f30ac3e08d82d214df560562fceacd7dd4f8db
- SSDEEP
  
  24576:5OObVw4TaN1wdkukCba4oXtgLhU3wEdmh581cndLxdmo+eXEVT3wvUzO:5OOh3aN4kuLbegmtG+cJrmemTgvC
Score

7^/10

spyware stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2