General

  • Target

    7ef77c120d97da284eccce764cf47c26c1a80457d53c2d011b6ba0288942f02f

  • Size

    6.5MB

  • MD5

    0505b8668e11aac4acd044495dffbb37

  • SHA1

    7718e707295a049de73f6c1ca193346aa772092d

  • SHA256

    7ef77c120d97da284eccce764cf47c26c1a80457d53c2d011b6ba0288942f02f

  • SHA512

    25e3b249e5fc4449657195cf7e7828ab307d50f1b6e58f3ef94d4dae25f6940a456ffce251492e1a396ae662d387b1b090ceaeac2ad6da6e8da8dd55998246a5

  • SSDEEP

    196608:JhaOjdQmRJ8dA6l7aycBIGpEyUXIZVchV88LG:vdQusl29bchV8p

Malware Config

Extracted

Family

cobaltstrike

C2

http://194.29.187.194:443/jquery-3.3.2.slim.min.js

Attributes
  • user_agent

    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

Signatures

  • Cobaltstrike family
  • Detects Pyinstaller 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 7ef77c120d97da284eccce764cf47c26c1a80457d53c2d011b6ba0288942f02f
    .exe windows x64

    0b5552dccd9d0a834cea55c0c8fc05be


    Headers

    Imports

    Sections

  • base.pyc