Extracted

• • Target

    2025-02-17_ef0e6cca86d589f1f58eebeec2389dc7_ismagent_ryuk_sliver

  • Size

    3.3MB

  • MD5

    ef0e6cca86d589f1f58eebeec2389dc7

  • SHA1

    6794f4d169f9ffed8e5f0e516e4f4bd046314e8e

  • SHA256

    8c050551019cbd3388affebbc0cd9c69ab565ca4c88d4388185e7baff2c6f3e4

  • SHA512

    46388a50b93ada414884eefb437bc7ab2f771afd3d91c73c3a683962a5b89aa722bf6456422bbea1cb5426572299b2039583751b4430abf2e9ed0752ff14bfd1

  • SSDEEP

    49152:FX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Qt:FlRsZ47/QXoHUOfAoj1x6t

  Score

  8^/10

  adwarediscoverypersistenceprivilege_escalationstealer

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Drops file in System32 directory

  behavioral1behavioral2