Overview

overview

10

Static

static

10

NEAS.f4907...JC.exe

windows7-x64

10

NEAS.f4907...JC.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    NEAS.f4907ffbe91c48f5841cc4be17e35300_JC.exe

  • Size

    370KB

  • MD5

    f4907ffbe91c48f5841cc4be17e35300

  • SHA1

    48b7e4d6feef6281505cae4e7695f6eb826e0999

  • SHA256

    c68235a00ba90b08a8cfd73b737d6bd6c36f839adf9d29f2380bf0d1d09e9754

  • SHA512

    b32f7c60dfddedac78717f32f6890ce5e59c860924a1930bff7806c5387fb51e7a06cde0739c33d52df05bc74723bb0fc7fb89d39ee290767cab14e6da929821

  • SSDEEP

    6144:8IWBBJCOxchA0nPiXhX8L8qrYwcjVhdG5jkOKV0w:FWbJCOxchA0nPiXhXHQ5jkv0w

Score
10/10
cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

C2

http://107.174.228.125:4356/jquery-3.3.2.slim.min.js

Attributes
  • user_agent

    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • NEAS.f4907ffbe91c48f5841cc4be17e35300_JC.exe
    .exe windows:6 windows x64

    30a51eadcc8304693835a0c04570544e


    Headers

    Imports

    Sections