5a03c35e85a0479504db68144d55ab02998b9d95bdcffb0dde924f3d1efbeeca | Triage

Sharing

General

Target

2024-08-28_2e5ae1eaa32ba2154bf516d54af9ec2e_cobalt-strike_ryuk
Size

11.8MB
Sample

240828-w7wqfasark
MD5

2e5ae1eaa32ba2154bf516d54af9ec2e
SHA1

add6e87164614a836841f9c964b3429fd7db0ca4
SHA256

5a03c35e85a0479504db68144d55ab02998b9d95bdcffb0dde924f3d1efbeeca
SHA512

c76091d5522ea347f782b0c8e38702bc1cf2c3a84b715fd0ffcb57baf29e4c88812b110b326a5f30d1dc8092dcd4d04116931d2c7955d82e03a750f1600a3b2e
SSDEEP

98304:Ny/Ig4Z0nj6Z+jBFRwoDES+a+yZu+quxSIrQ6b0LDz9Fe0QxoMDMFb1:Xgg0jV0ta+E5Dr30qPx

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  2024-08-28_2e5ae1eaa32ba2154bf516d54af9ec2e_cobalt-strike_ryuk
- Size
  
  11.8MB
- MD5
  
  2e5ae1eaa32ba2154bf516d54af9ec2e
- SHA1
  
  add6e87164614a836841f9c964b3429fd7db0ca4
- SHA256
  
  5a03c35e85a0479504db68144d55ab02998b9d95bdcffb0dde924f3d1efbeeca
- SHA512
  
  c76091d5522ea347f782b0c8e38702bc1cf2c3a84b715fd0ffcb57baf29e4c88812b110b326a5f30d1dc8092dcd4d04116931d2c7955d82e03a750f1600a3b2e
- SSDEEP
  
  98304:Ny/Ig4Z0nj6Z+jBFRwoDES+a+yZu+quxSIrQ6b0LDz9Fe0QxoMDMFb1:Xgg0jV0ta+E5Dr30qPx
Score

7^/10

spyware stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops file in System32 directory
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1