Overview

overview

10

Static

static

10

4.exe

windows7-x64

10

4.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    4.exe

  • Size

    6.1MB

  • MD5

    dd054ef2954fb672109abbc02647b91f

  • SHA1

    d942d791e981aa71d1ab2be5de6e2fb25c7cf2ce

  • SHA256

    65e33758302a2c2f43b9bc99c8acb14625c45676a7ed132d9d3545871cc4f516

  • SHA512

    04ee2b908c6d1aa1d9cf86409616a8c4ed965e3b7aad815bb8495779d73d6ad6e38582a2410f57aa5ee9ce87d3139d3cd05abdf697c9b160f283d6994717105c

  • SSDEEP

    196608:CH85UuWJysVYvsO2DeECRl2Ewf8jlEOeCVxK:xWJ4Hyku3CXK

Score
10/10
pyinstallercobaltstrike

Malware Config

Extracted

Family

cobaltstrike

C2

http://182.61.45.3:15555/RyFL

Attributes
  • user_agent

    User-Agent: Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 5.2) Java/1.5.0_08

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 4.exe
    .exe windows x64

    c5640c7a22008f949f9bc94a27623f95


    Headers

    Imports

    Sections

  • shellcode.pyc