Extracted

• • Target

    2024-10-08_fc98f5d0bc1552483a44c85d53384a6e_ryuk

  • Size

    14.0MB

  • MD5

    fc98f5d0bc1552483a44c85d53384a6e

  • SHA1

    d696097fec437d4f31739d1460b180e67795b9d6

  • SHA256

    33a32609cb5acf54abeef9eed08d24a03dfd138ddd4b6132c8add72d8232b43a

  • SHA512

    5b3f9769de97b61568611ed852efcdcb52d9d2371026dc434aeab2f42197cc6a876a24c1132ec0861bd6895c7c9ca164370da9ae63009bd4432ef8ed9dddefa4

  • SSDEEP

    393216:IxhOGfw/zTNVC2bH2McKpqeTP91UIU537BEBE/P:aIoszT7C2KMzg537iBEH

  Score

  10^/10

  hackbrowserdatadiscoveryexecutioninfostealerspywarestealer

  • An open source browser data exporter written in golang.

  • HackBrowserData

    An open source golang web browser extractor.

    infostealerhackbrowserdata

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2