Overview

overview

10

Static

static

10

256.exe

windows7-x64

256.exe

windows10-2004-x64

568_upx.exe

windows7-x64

7

568_upx.exe

windows10-2004-x64

7

croc.exe

windows7-x64

1

croc.exe

windows10-2004-x64

1

cromium.exe

windows7-x64

10

cromium.exe

windows10-2004-x64

10

ddd.exe

windows7-x64

ddd.exe

windows10-2004-x64

locked.exe

windows7-x64

locked.exe

windows10-2004-x64

vmware-logs.dll

windows7-x64

1

vmware-logs.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    MaliciousChrome.zip

  • Size

    3.7MB

  • MD5

    568a6cffebb0941f55ad475ae1996ff6

  • SHA1

    f2ce5825822ad2f9999af5e4bd5308be9474db96

  • SHA256

    24b0f716eb5013a2ba80c0a6f444eb95ac6d6859065539b103d9ba2b088ead63

  • SHA512

    3e0d83547a5df4ec1376715121d5c4057f9efff76c48fb0684cb8e27ae16115b075e5eb5df3c4aba14f7e52f296dba4964f0329ac37160d579b018e2ae3cf7a7

  • SSDEEP

    98304:G5ZPsQocrwgucYp8BpU3OGTEw5yg6+ng8XYBK2uw:G/P7okB+3OGA+ygvg8XYBpj

Score
10/10
upxcobaltstrike

Malware Config

Extracted

Family

cobaltstrike

C2

http://185.170.42.93:8085/9Enq

Attributes
  • user_agent

    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)

Signatures

  • Cobaltstrike family
    cobaltstrike
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • MaliciousChrome.zip
    .zip
  • 256.exe
  • 568_upx.exe
    .exe windows x64


    Headers

    Sections

  • LICENSE
  • README.md
  • bash_autocomplete
  • croc.exe
    .exe windows x64

    9cbefe68f395e67356e2a5d8d1b285c0


    Headers

    Imports

    Sections

  • cromium.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • ddd.exe
  • locked.exe
  • vmware-logs.1logs
    .dll windows x64


    Headers

    Sections

  • zsh_autocomplete