General
- Target 240911-aseygssepl_pw_infected.zip
- Size 65KB
- Sample250130-t73smsynhn
- SHA256 7bac5c10d02534007f1efb371885ae3918d21d394371f92d4e6455b58b4e16ad
Score
10/10
Malware Config
Targets
-
- Target 2024-09-11_13f929e2cc03dbe1780cce33b7dce110_ryuk
- Size 436KB
- SHA256 dcb9ec0cc6bdce89df3df0c0ca4170829f6897decd78c5365ea6e7802f3c0941
Score10/10Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
Ryuk family
Renames multiple (8077) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
Drops startup file
Modifies file permissions
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Drops desktop.ini file(s)
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1