c53a5862ac68eafa66dd4ff5bc0d18636b88838017e8bdab64f4c7668a19a7ab | Triage

Sharing

General

Target

2024-08-14_cbe88b139c373792a8f9cfea1116e00f_cobalt-strike_ryuk
Size

4.9MB
Sample

240814-w9pd5sxdmd
MD5

cbe88b139c373792a8f9cfea1116e00f
SHA1

5c1058ba01b2a886aa8c342f865027967340ea27
SHA256

c53a5862ac68eafa66dd4ff5bc0d18636b88838017e8bdab64f4c7668a19a7ab
SHA512

59250d6c2dc8064131492a094e72d6c065bdae296ad02299608a66e7445860d1f22fc952a909c07667e63d18d798b0e16712efc2086413e395955b6c8d9fe296
SSDEEP

49152:bFUKRj79S2QAoZg6ig1q2bDi1ZTKU1VCqh1S9/Y7BVSMJG9IXy5qPxwr9/4Zt5EE:B/DuUyq7Y4QQyqqwZ0E

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  2024-08-14_cbe88b139c373792a8f9cfea1116e00f_cobalt-strike_ryuk
- Size
  
  4.9MB
- MD5
  
  cbe88b139c373792a8f9cfea1116e00f
- SHA1
  
  5c1058ba01b2a886aa8c342f865027967340ea27
- SHA256
  
  c53a5862ac68eafa66dd4ff5bc0d18636b88838017e8bdab64f4c7668a19a7ab
- SHA512
  
  59250d6c2dc8064131492a094e72d6c065bdae296ad02299608a66e7445860d1f22fc952a909c07667e63d18d798b0e16712efc2086413e395955b6c8d9fe296
- SSDEEP
  
  49152:bFUKRj79S2QAoZg6ig1q2bDi1ZTKU1VCqh1S9/Y7BVSMJG9IXy5qPxwr9/4Zt5EE:B/DuUyq7Y4QQyqqwZ0E
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2