Behavioral task
behavioral1
Sample
2a17457978b4135f04cfcbb9de34a71755ec4611e52674ea2eb1b26d6b098565.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2a17457978b4135f04cfcbb9de34a71755ec4611e52674ea2eb1b26d6b098565.dll
Resource
win10v2004-20230915-en
General
-
Target
2a17457978b4135f04cfcbb9de34a71755ec4611e52674ea2eb1b26d6b098565
-
Size
5KB
-
MD5
ac369945eb95d461c2c0cebb4c66abd8
-
SHA1
0e77cea61ef73b1c38716bab88a0bde882a427dc
-
SHA256
2a17457978b4135f04cfcbb9de34a71755ec4611e52674ea2eb1b26d6b098565
-
SHA512
6243702762c0ebc92df7dab4169695e14f8a650960d31659be001a57e3d207373d753f67a3c08af821688e2d08de1cbf10cae7990981d5d5a4b02f3a9f8062fc
-
SSDEEP
96:H7T3uabBLYoqEYCH2AHDA11EQJ5krQaRF:HHPH2AM1JAx
Malware Config
Extracted
cobaltstrike
http://103.146.179.71:8855/jquery-3.3.2.slim.min.js
-
user_agent
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; MALEJS; rv:11.0) like Gecko
Signatures
-
Cobaltstrike family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2a17457978b4135f04cfcbb9de34a71755ec4611e52674ea2eb1b26d6b098565
Files
-
2a17457978b4135f04cfcbb9de34a71755ec4611e52674ea2eb1b26d6b098565.dll windows:4 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 656B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ