General

  • Target

    2024-11-09_38bf7c321c006d401d541f9581b987ed_cobalt-strike_ryuk

  • Size

    1.8MB

  • Sample

    241109-1xyt9stcjj

  • MD5

    38bf7c321c006d401d541f9581b987ed

  • SHA1

    e4b69b2074cc391edcd715b4398414c51b84c662

  • SHA256

    9697914e1f160e83acf10867c2be2dd1b9d8b09934b8842f78d44565556711fd

  • SHA512

    ef0975f1f07936ae4454074ab6d20c9f74a2c5fd0f1dc993a1b2fe437a399a115c9a118aeb6f24d568f4415e0157ab538b6d3c7859b1cfe2fafe398245ba0b52

  • SSDEEP

    49152:lKfuPS3ELNjV7SZxEfOfOgwf0TB+kn3Hnx:um9OZxwgF+k

Malware Config

Targets

    • Target

      2024-11-09_38bf7c321c006d401d541f9581b987ed_cobalt-strike_ryuk

    • Size

      1.8MB

    • MD5

      38bf7c321c006d401d541f9581b987ed

    • SHA1

      e4b69b2074cc391edcd715b4398414c51b84c662

    • SHA256

      9697914e1f160e83acf10867c2be2dd1b9d8b09934b8842f78d44565556711fd

    • SHA512

      ef0975f1f07936ae4454074ab6d20c9f74a2c5fd0f1dc993a1b2fe437a399a115c9a118aeb6f24d568f4415e0157ab538b6d3c7859b1cfe2fafe398245ba0b52

    • SSDEEP

      49152:lKfuPS3ELNjV7SZxEfOfOgwf0TB+kn3Hnx:um9OZxwgF+k

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks