Overview

overview

10

Static

static

10

e2fd1a6492...ca.exe

windows7-x64

10

e2fd1a6492...ca.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    e2fd1a649286ede525993b8b5632b48d812d30adb8bd3000ca430654c68f39ca

  • Size

    10KB

  • MD5

    7f269f72c5c7126a455af87b4f2deec2

  • SHA1

    b69a966c17ba64f4d270e525ac7c3c5892a61e92

  • SHA256

    e2fd1a649286ede525993b8b5632b48d812d30adb8bd3000ca430654c68f39ca

  • SHA512

    4f470ea6b26431ef7c4e28410749167dd9340559f1c7d7ca1b60efd0aab34f3c6f8a369bce2c554ba01312c4f4420dc5162ba7ca8a9e492b53c74e9d0667e280

  • SSDEEP

    192:xWyHHfwD6pZ/f6vM8Z4jOmHQtKzkJ7E5pz6gEJT:FHfx/fyMe4jStKAJ7k

Score
10/10
cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

C2

http://172.16.1.210:8090/jquery-3.3.2.slim.min.js

Attributes
  • user_agent

    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • e2fd1a649286ede525993b8b5632b48d812d30adb8bd3000ca430654c68f39ca
    .exe windows x86

    aa9cafece99268e56412ec6b04434df3


    Headers

    Imports

    Sections