Overview

overview

10

Static

static

10

4850b35621...8d.exe

windows7-x64

10

4850b35621...8d.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    4850b3562138bad5e93e0b7d5813b54ff0b671c724acac4039226695dd70098d

  • Size

    984KB

  • MD5

    cfa5a587a79d315266037c9062418404

  • SHA1

    38de124489e1818da1f38625a4efcde6785a0e0f

  • SHA256

    4850b3562138bad5e93e0b7d5813b54ff0b671c724acac4039226695dd70098d

  • SHA512

    bcc92b3e1dce87a3254b8f9e33c5d0d5f876ad96489dc2b4e15fe0de8ecc24f41a9a0a5fcb381fc3d136965ec2f844d0b8325d3af96b26211a8114850ed19161

  • SSDEEP

    24576:C1ytWZocm609AbXA1iSyuIKpJRXY1taRxtFyxn3AkScJ:LWZocm609AbXn3uIKpJZY1IRxtMxn3Au

Score
10/10
upxcobaltstrike

Malware Config

Extracted

Family

cobaltstrike

C2

http://192.168.1.201:80/JwBZ

Attributes
  • user_agent

    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MASP)

Signatures

  • Cobaltstrike family
    cobaltstrike
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 4850b3562138bad5e93e0b7d5813b54ff0b671c724acac4039226695dd70098d
    .exe windows:6 windows x64 arch:x64


    Headers

    Sections

  • out.upx
    .exe windows:6 windows x64 arch:x64


    Headers

    Sections