Overview

overview

10

Static

static

10

ea3216d0a6...fe.exe

windows7-x64

10

ea3216d0a6...fe.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ea3216d0a64b7c9cdb8bd590e45114fe

  • Size

    9.3MB

  • MD5

    ea3216d0a64b7c9cdb8bd590e45114fe

  • SHA1

    518f62c33852f46b685ce747a48d473f441505a2

  • SHA256

    9df2417359899957484e903a40725ffc6e7775d80f94ccb09f4190bedc8d8eca

  • SHA512

    a969e373fd27e80089a07b9ebcd4d52adf2aea68862f82d499552ac633bcb61072952fa52b83a89d60c9e7c4b74923b87c055fe62c1dfd49487a11d3705c6f38

  • SSDEEP

    196608:T/T2fHrODpFC4g0AVIGv38ZJ9BIBxIFO48RmU/0ZlsPvmucO8C5VHTSfn:7TEKLgtIGiYXIotN0ZWLH2

Score
10/10
pyinstallercobaltstrike

Malware Config

Extracted

Family

cobaltstrike

C2

http://192.168.254.130:3232/JSiW

Attributes
  • user_agent

    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; qdesk 2.4.1263.203; Windows NT 6.1; WOW64; Trident/5.0)

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • ea3216d0a64b7c9cdb8bd590e45114fe
    .exe windows:5 windows x64 arch:x64

    ba54e48d0f0346b349e9f7a2c8ecaf5c


    Headers

    Imports

    Sections

  • test01.pyc