Overview

overview

10

Static

static

10

ae8b295a1f...ef.exe

windows7-x64

10

ae8b295a1f...ef.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ae8b295a1f5b92a975eb611762d4ccef3996eed881eb3a708f16b76b12f5a5ef

  • Size

    874KB

  • MD5

    ebe677c036327a111b901358888156a1

  • SHA1

    19cdd7c06ec34ed881468b291dbf8d9fc1aa118e

  • SHA256

    ae8b295a1f5b92a975eb611762d4ccef3996eed881eb3a708f16b76b12f5a5ef

  • SHA512

    245ced08ae2c020911d68f1d35f951d0b200764153a4f1450e5839dfabf8bb5fe7eaa3c5d6b1dc01c91e375cce04cfa95d1004a2cecaa0dc8f735cbf5b713a1f

  • SSDEEP

    12288:5f0tbigiUkyyhXKPC1+mngEXH8NE4ooasZqbo13csYgtjjCzQ/:5fCb1ibybPC1rnpXH8i/OcsYgt3CzQ/

Score
10/10
cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

C2

http://192.168.233.140:8080/jquery-3.3.2.slim.min.js

Attributes
  • user_agent

    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • ae8b295a1f5b92a975eb611762d4ccef3996eed881eb3a708f16b76b12f5a5ef
    .exe windows:6 windows x64 arch:x64

    f0ea7b7844bbc5bfa9bb32efdcea957c


    Headers

    Imports

    Sections