General

  • Target

    cb026b7cab6744ac5088efa876b7896f70c42fce909483e6fb0f8caef81a82fe.exe

  • Size

    1.1MB

  • Sample

    240325-nyplrsef93

  • MD5

    58730ad2998ffdd37c4c87b7a5e1164c

  • SHA1

    50d4df352512938aa10d9601daa62b7a8b207298

  • SHA256

    cb026b7cab6744ac5088efa876b7896f70c42fce909483e6fb0f8caef81a82fe

  • SHA512

    bbf552819ffade9dc45289ae60cf8cbd9fe8fa1a77f520adaa411b25de710e791dc0b90e0f34a20c9adb7adcc934ef39cb70ebbafee1c8fcc9ceb0b676c13684

  • SSDEEP

    12288:/EnX6Sl6lM0RjnQSjnmTkfoZ66sabuDzBx9QCnzdouupDHR:/w/lgM0tnl73a8BwCziuu

Malware Config

Extracted

Family

cobaltstrike

C2

http://120.48.70.155:50022/JmQU

Attributes
  • user_agent

    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENCA)

Targets

    • Target

      cb026b7cab6744ac5088efa876b7896f70c42fce909483e6fb0f8caef81a82fe.exe

    • Size

      1.1MB

    • MD5

      58730ad2998ffdd37c4c87b7a5e1164c

    • SHA1

      50d4df352512938aa10d9601daa62b7a8b207298

    • SHA256

      cb026b7cab6744ac5088efa876b7896f70c42fce909483e6fb0f8caef81a82fe

    • SHA512

      bbf552819ffade9dc45289ae60cf8cbd9fe8fa1a77f520adaa411b25de710e791dc0b90e0f34a20c9adb7adcc934ef39cb70ebbafee1c8fcc9ceb0b676c13684

    • SSDEEP

      12288:/EnX6Sl6lM0RjnQSjnmTkfoZ66sabuDzBx9QCnzdouupDHR:/w/lgM0tnl73a8BwCziuu

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks