cobaltstrike | 0601496bd5fb832f878283c3c09624dc47fb68533dd2c0fde530275a7cb6f776

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 13:57

Target

0601496bd5fb832f878283c3c09624dc47fb68533dd2c0fde530275a7cb6f776.exe
Size

19KB
MD5

8b6ede96a0812ccf78f2c438af184837
SHA1

653fbb999f856ed57faa82a46e7b019867274ff5
SHA256

0601496bd5fb832f878283c3c09624dc47fb68533dd2c0fde530275a7cb6f776
SHA512

54102401c83aa6bf5ddcd7dad8609ea039c2757962ecdab338950842b5b412e3e2c13454bbc3fb36311be18a0773bfc7a054101d3228e9cb3084f83e6ee3c5f4
SSDEEP

192:DV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/202kX5s6WF8qa1Dojjgi:tqaCF31cix+Dc4zjdrsjFF46gi

Score

10^/10

Family

cobaltstrike

http://101.37.12.194:60032/NalB

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; MALNJS)

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

C:\Users\Admin\AppData\Local\Temp\0601496bd5fb832f878283c3c09624dc47fb68533dd2c0fde530275a7cb6f776.exe
"C:\Users\Admin\AppData\Local\Temp\0601496bd5fb832f878283c3c09624dc47fb68533dd2c0fde530275a7cb6f776.exe"
1⤵
PID:2580

memory/2580-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2580-1-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download