2024-09-25_48ec9fadfe763b39e54a069f7b317158_cobalt-strike_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-09-25_48ec9fadfe763b39e54a069f7b317158_cobalt-strike_ryuk
Size

2.8MB
MD5

48ec9fadfe763b39e54a069f7b317158
SHA1

1846ae59713ed0a931fa02bb82f7ef381cd51cf7
SHA256

2507c4ad489b53e9d9d7cd9c5f10c6fceaa2645f0dff907a448c668bb8fa0379
SHA512

4ef657dfc7d4be40419ea06a3ecb8fe77c685e2a2c5208a1f9deebf29aaaccbabae45240911096cceb9fc5464f61729e038c2bdd3dacae501a74cffb15cb48d6
SSDEEP

49152:4UOCLOZFh5Mo3V9F2as16LGPd5pO7Hs8D4sQ3aw6QpElr7saMo:jCFj2asie5pOg8D4srmusaJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-09-25_48ec9fadfe763b39e54a069f7b317158_cobalt-strike_ryuk

Files

2024-09-25_48ec9fadfe763b39e54a069f7b317158_cobalt-strike_ryuk
.exe windows:5 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 333KB - Virtual size: 333KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gxfg
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.retplne
Size: 512B - Virtual size: 116B

.tls
Size: 512B - Virtual size: 449B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.voltbl
Size: 512B - Virtual size: 68B

CPADinfo
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

malloc_h
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 333KB - Virtual size: 333KB

.data Size: 64KB - Virtual size: 115KB

.pdata Size: 59KB - Virtual size: 59KB

.00cfg Size: 512B - Virtual size: 40B

.gxfg Size: 12KB - Virtual size: 11KB

.retplne Size: 512B - Virtual size: 116B

.tls Size: 512B - Virtual size: 449B

.voltbl Size: 512B - Virtual size: 68B

CPADinfo Size: 512B - Virtual size: 56B

_RDATA Size: 512B - Virtual size: 244B

malloc_h Size: 2KB - Virtual size: 1KB

.rsrc Size: 137KB - Virtual size: 136KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 333KB - Virtual size: 333KB

.data
Size: 64KB - Virtual size: 115KB

.pdata
Size: 59KB - Virtual size: 59KB

.00cfg
Size: 512B - Virtual size: 40B

.gxfg
Size: 12KB - Virtual size: 11KB

.retplne
Size: 512B - Virtual size: 116B

.tls
Size: 512B - Virtual size: 449B

.voltbl
Size: 512B - Virtual size: 68B

CPADinfo
Size: 512B - Virtual size: 56B

_RDATA
Size: 512B - Virtual size: 244B

malloc_h
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 137KB - Virtual size: 136KB

.reloc
Size: 9KB - Virtual size: 9KB