Overview

overview

10

Static

static

10

023bc14092...56.exe

windows7-x64

10

023bc14092...56.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    023bc1409233dab2c12c1bdf5849ba32aba669fd59cc91246b580cc62ce1a456

  • Size

    527KB

  • MD5

    7843484d295d1889a9b1cc9866f6850c

  • SHA1

    cb545ed308b532a044b9c47477f82fa459dae2ec

  • SHA256

    023bc1409233dab2c12c1bdf5849ba32aba669fd59cc91246b580cc62ce1a456

  • SHA512

    36d3c96ad79f95e631e61fc28d7b7d62ba98531d0a320771b8f25bce02ca5c5deb85c207121d6e4731ea108d741633161b3044bdf07545a182b962eb0703cac9

  • SSDEEP

    12288:ey1pv7H4p8xsLhvT9zD1xuqgk4XShf7cSZpKyj5Ej/e:ey1pjH41Hngkhrz5Ej/e

Score
10/10
upxcobaltstrike

Malware Config

Extracted

Family

cobaltstrike

C2

http://100.98.212.46:443/jquery-3.3.2.slim.min.js

Attributes
  • user_agent

    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: jqeury.com

Signatures

  • Cobaltstrike family
    cobaltstrike
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 023bc1409233dab2c12c1bdf5849ba32aba669fd59cc91246b580cc62ce1a456
    .exe windows x64


    Headers

    Sections

  • out.upx
    .exe windows x64


    Headers

    Sections