Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2025-01-07_bec59ef4a85d4996622a0cad150f752c_cobalt-strike_ryuk
-
Size
3.1MB
-
Sample
250107-mtm2pszkfk
-
MD5
bec59ef4a85d4996622a0cad150f752c
-
SHA1
4414781aed2bad425cad3d36e3748f3e3d211747
-
SHA256
60e66e1f5f94ae12b02e0198be4b70ec2b2abaa0e98df8d74f9583c8764fdca9
-
SHA512
9bc032eef38daf863cb3425aeb2901d80c8cca269f3b47c2466338568e6ed22764b8230d391921c9de6df9dcd33fd35b87201fd73f35e200c70cfcec9a67d643
-
SSDEEP
24576:qiiQwp8/5mM/oOUR/K/hKW+XOuU5rciNcKwDuNaBnAPhgo/ue9VX+sPAfNKuwb8G:UQZgJdytNcJYpDp+UmQuwP5nZm
Static task
static1
Behavioral task
behavioral1
Sample
2025-01-07_bec59ef4a85d4996622a0cad150f752c_cobalt-strike_ryuk.exe
Resource
win7-20241010-en
Malware Config
Extracted
meduza
45.130.145.152
-
anti_dbg
true
-
anti_vm
true
-
build_name
Work
-
extensions
.txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite
-
grabber_max_size
4.194304e+06
-
port
15666
-
self_destruct
false
Targets
-
-
Target
2025-01-07_bec59ef4a85d4996622a0cad150f752c_cobalt-strike_ryuk
-
Size
3.1MB
-
MD5
bec59ef4a85d4996622a0cad150f752c
-
SHA1
4414781aed2bad425cad3d36e3748f3e3d211747
-
SHA256
60e66e1f5f94ae12b02e0198be4b70ec2b2abaa0e98df8d74f9583c8764fdca9
-
SHA512
9bc032eef38daf863cb3425aeb2901d80c8cca269f3b47c2466338568e6ed22764b8230d391921c9de6df9dcd33fd35b87201fd73f35e200c70cfcec9a67d643
-
SSDEEP
24576:qiiQwp8/5mM/oOUR/K/hKW+XOuU5rciNcKwDuNaBnAPhgo/ue9VX+sPAfNKuwb8G:UQZgJdytNcJYpDp+UmQuwP5nZm
-
Meduza Stealer payload
-
Meduza family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-