Overview

overview

10

Static

static

10

d6bfcbbc63...21.exe

windows7-x64

7

d6bfcbbc63...21.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d6bfcbbc6323c19d77f1c929b2cbc3720392b11f7bf88b81759bdf0b54fe2421

  • Size

    6.5MB

  • MD5

    db411e5e0890c365dc9454995134c668

  • SHA1

    ff5e555d3a64ae7b022ecbfe02f91683688d1bc0

  • SHA256

    d6bfcbbc6323c19d77f1c929b2cbc3720392b11f7bf88b81759bdf0b54fe2421

  • SHA512

    e6cee0139ba4dd93d421670a83d34efa138c9a00fd6475b255fe81de23da9c897b52021b3ad36e196b285a92ed72fcaef1d6f3f3d8accbdb13bf08a3c852b6ec

  • SSDEEP

    196608:CYaOjdQmRJ8dA6l7aycBIGpEyUXIZVcsxL:DdQusl29bcs

Score
10/10
pyinstallercobaltstrike

Malware Config

Extracted

Family

cobaltstrike

C2

http://194.29.187.194:443/jquery-3.3.2.slim.min.js

Attributes
  • user_agent

    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • d6bfcbbc6323c19d77f1c929b2cbc3720392b11f7bf88b81759bdf0b54fe2421
    .exe windows x64

    0b5552dccd9d0a834cea55c0c8fc05be


    Headers

    Imports

    Sections

  • advanced.pyc