Overview

overview

10

Static

static

10

3c1b336cc0...fc.exe

windows7-x64

10

3c1b336cc0...fc.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    3c1b336cc0498e822f88f0eadf1324394f398d6eafb6b993fcaa1eb1c432d8fc

  • Size

    131KB

  • MD5

    f6a61dd562344e51a8b6564124ee8567

  • SHA1

    3b185f5464df17589542303d4c240c26c15c6171

  • SHA256

    3c1b336cc0498e822f88f0eadf1324394f398d6eafb6b993fcaa1eb1c432d8fc

  • SHA512

    8baa80c81ceb1fd539bbec9d610d5406eeea4ae7600e9222b89e4cbdb9375753423812673ae49c26c52787de374857fc5941160788603e738a105651ae5c9774

  • SSDEEP

    1536:e5KmgHonsXyCmaTXRS8oeWgHDI7Q1tAUvMFMQiNuRTIe3Ip7Us:Jm1ohSYHDI7Q1tovRke3IOs

Score
10/10
cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

C2

http://121.5.196.25:8889/jquery-3.3.2.min.js

Attributes
  • user_agent

    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Host: c.bywe.xyz Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.0)

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 3c1b336cc0498e822f88f0eadf1324394f398d6eafb6b993fcaa1eb1c432d8fc
    .exe windows:4 windows x64

    3b33b265ba92f003445fc71882fc1af3


    Headers

    Imports

    Sections