Overview

overview

10

Static

static

10

f8d97b3857...f1.exe

windows7-x64

1

f8d97b3857...f1.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    f8d97b38579141b47d574146c6539b0e67b30dc390aa53ae5aea39a90b15c5f1

  • Size

    3.5MB

  • MD5

    59b5c1a79311481c1a9fe956f73fbc58

  • SHA1

    8ffc88b6891026f54dc70867a75689c488ddf2fd

  • SHA256

    f8d97b38579141b47d574146c6539b0e67b30dc390aa53ae5aea39a90b15c5f1

  • SHA512

    8ec8e35a43e57437cac59a1f53efb3fd33ad8250e3cc1be595a37fbb950185088043eff3ec8caf3a8aba4db7b8340d8cdbc9e3928bcb36cd174e92549a41ab57

  • SSDEEP

    49152:jkYBr+xjCrb/TkvO90d7HjmAFd4A64nsfJZWCVW6uglU6ckoB/+BrJC1aGm/+y9q:ajuM/+Bjt2yaq1hZ0IY

Score
10/10
cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

C2

http://172.20.254.133:80/FMsW?test1=test2

Attributes
  • user_agent

    Host: whatever.com Accept: */* Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/587.38 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • f8d97b38579141b47d574146c6539b0e67b30dc390aa53ae5aea39a90b15c5f1
    .exe windows:6 windows x64 arch:x64

    65892a964106b5e0c6c363fdf21975eb


    Headers

    Imports

    Sections