Overview

overview

10

Static

static

10

422a930a54...95.exe

windows7-x64

7

422a930a54...95.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    422a930a54331488a17283f6a7d888911aac01bf11e13611150654ddf7e24b95

  • Size

    6.4MB

  • MD5

    14396333b888479ab5e08f22d6b726be

  • SHA1

    e53ff2a40deb96fe67f7d0100daf1bef7a5130db

  • SHA256

    422a930a54331488a17283f6a7d888911aac01bf11e13611150654ddf7e24b95

  • SHA512

    1b18a8fd336785371dd4348823ef0797aa8f260aedaf60870f2094d306a6fc6d4c699d5f888980957234b26a43f5df32da199aff848be3298a90a4c0bdf24b48

  • SSDEEP

    98304:Ar8bQezhQ/z0qRXeRt7Nb+sX1ZvbeAyJZ34Z0FGRABTgtse62g05IPzovkFSZA6Q:ArqhQgQOz7NCsXDjDyf3ZkdNjMFEA0m

Score
10/10
pyinstallercobaltstrike

Malware Config

Extracted

Family

cobaltstrike

C2

http://192.168.40.129:80/oTLN

Attributes
  • user_agent

    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E)

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 422a930a54331488a17283f6a7d888911aac01bf11e13611150654ddf7e24b95
    .exe windows x64

    ba5546933531fafa869b1f86a4e2a959


    Headers

    Imports

    Sections

  • bd.pyc