Overview

overview

10

Static

static

10

280a0beb86...fb.exe

windows7-x64

10

280a0beb86...fb.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    280a0beb862d583f0c4914640387863305fade3d20f07aff11432ae793ea1efb

  • Size

    3.7MB

  • MD5

    d0a1be658aae458f4c27a43960b8ec2a

  • SHA1

    0f75732528a3b4a49c8a10828e275313e086b8fb

  • SHA256

    280a0beb862d583f0c4914640387863305fade3d20f07aff11432ae793ea1efb

  • SHA512

    1b89f9eea28a8674930e8fb57a4d248bc21505f272cdff0642275e60459ed84c7cebe125f725b495e98f85c841862527071a7ab9c5af788d13e6a710ff6a949e

  • SSDEEP

    98304:oq8XOgoxATdTBBGzQuKLQ59PzN26btqXMjaEu7:oqkVhtBBGZlrQaQrE4

Score
10/10
pyinstallercobaltstrike

Malware Config

Extracted

Family

cobaltstrike

C2

http://service-jw5nux1q-1258596386.gz.apigw.tencentcs.com:443/bootstrap-2.min.js

Attributes
  • user_agent

    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 280a0beb862d583f0c4914640387863305fade3d20f07aff11432ae793ea1efb
    .exe windows:5 windows x64

    0bbecc8e9f9f17b0ea9cc3899b15e5cf


    Headers

    Imports

    Sections

  • shellcode.pyc