Static task
static1
Behavioral task
behavioral1
Sample
2024-08-25_bce8e4b81fead30f03907860a62c33b6_cobalt-strike_ryuk.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-08-25_bce8e4b81fead30f03907860a62c33b6_cobalt-strike_ryuk.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-25_bce8e4b81fead30f03907860a62c33b6_cobalt-strike_ryuk
-
Size
3.2MB
-
MD5
bce8e4b81fead30f03907860a62c33b6
-
SHA1
7ce806536d9f945914c31d735f2c9a1176746ca7
-
SHA256
d93267d4db096c97dadca4b55e7445cf64358eb6cd8ba9958a7f4a40b2ad042f
-
SHA512
aed2390c15aa801bcbe2d05434efc8cfaa3b8e75656f28430d9871edf8629f7fffb092ff8f3858633fb828d2f83d6bb1fe0dbaeaeaa178cd18f8c32111aa6bd9
-
SSDEEP
49152:Q18MAFpnnJH9BUfKn+95lRVfAa0Vg76Lo2E2T8avTl2y/Bw:3MA3vBUGHo+m
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-08-25_bce8e4b81fead30f03907860a62c33b6_cobalt-strike_ryuk
Files
-
2024-08-25_bce8e4b81fead30f03907860a62c33b6_cobalt-strike_ryuk.exe windows:5 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: - Virtual size:
Size: 1216.0MB - Virtual size:
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
ary Size: 1239.3MB - Virtual size: 1591.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
ageA Size: 1654.1MB - Virtual size: 1558.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
�������a Size: 514.0MB - Virtual size: 1554.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
eA Size: 1556.5MB - Virtual size: 1622.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
�LoadLib Size: 1862.3MB - Virtual size: 1943.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Dwing@ Size: 1024KB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
�� Size: 9.0MB - Virtual size: 28.0MB
� Size: - Virtual size: 36.0MB
����� Size: 28.2MB - Virtual size:
Size: - Virtual size: 18KB
�N�� Size: - Virtual size: