Overview

overview

10

Static

static

10

50d5603032...9a.exe

windows7-x64

10

50d5603032...9a.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    50d56030324786c01e128aadc6ef69f2e61bc2c4ecd298302e00f35270a6ec9a

  • Size

    197KB

  • MD5

    618d581d898af30fd1c9d4fe676e1435

  • SHA1

    5739eab608145708e71c3222c8e8d5f9d1009c61

  • SHA256

    50d56030324786c01e128aadc6ef69f2e61bc2c4ecd298302e00f35270a6ec9a

  • SHA512

    ff6638408b05483800213f405a46413db7d186350aa51a90c81d78089e97535a7ccee22bed3092ac0042fa938f174932f7843c73ea007d4df3032db6068c5568

  • SSDEEP

    1536:46y0JYIruPwT6LmXvcZRcHBfJVUXWUm1Pk6SF2/s+jzyUUiMElvTvuXVr8pFAd27:46HYqQ26LprutOIXDM4iPvYFF7ouP

Score
10/10
cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

C2

http://192.168.151.2:4433/jquery-3.3.2.slim.min.js

Attributes
  • user_agent

    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 50d56030324786c01e128aadc6ef69f2e61bc2c4ecd298302e00f35270a6ec9a
    .exe windows:4 windows x64 arch:x64

    fc9d6b83974d2324d49129d7e5c39e42


    Headers

    Imports

    Sections