General
-
Target
58f40f4f8f24b7bc27fef06b056f8f6b653208118c2cf0326e94648132fa1430
-
Size
1.5MB
-
Sample
240415-1ea1gsha42
-
MD5
ea63c0e69c4a9c30d9af4afe2bdf5cfd
-
SHA1
97ee05ba4442d3a5372ffaa372b327d0f6f9e655
-
SHA256
58f40f4f8f24b7bc27fef06b056f8f6b653208118c2cf0326e94648132fa1430
-
SHA512
0ba32bef9b92b10079eb621e8ac32fd27987d45f00a0b1704ae29210f2906e4344d77801e5d120a9d02ce5e0e8742468dc0ab2c9d869d9027f5390299589cc0c
-
SSDEEP
24576:EVAtAQfLY08PFDyKfPVXL5u+gyQQ/hffpLAeMcUg9sB26wn6fbQhPZ:E4dkV54UAkZ
Static task
static1
Behavioral task
behavioral1
Sample
58f40f4f8f24b7bc27fef06b056f8f6b653208118c2cf0326e94648132fa1430.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
58f40f4f8f24b7bc27fef06b056f8f6b653208118c2cf0326e94648132fa1430.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
cobaltstrike
http://69.235.177.76:17777/jquery-3.3.2.slim.min.js
-
user_agent
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
Targets
-
-
Target
58f40f4f8f24b7bc27fef06b056f8f6b653208118c2cf0326e94648132fa1430
-
Size
1.5MB
-
MD5
ea63c0e69c4a9c30d9af4afe2bdf5cfd
-
SHA1
97ee05ba4442d3a5372ffaa372b327d0f6f9e655
-
SHA256
58f40f4f8f24b7bc27fef06b056f8f6b653208118c2cf0326e94648132fa1430
-
SHA512
0ba32bef9b92b10079eb621e8ac32fd27987d45f00a0b1704ae29210f2906e4344d77801e5d120a9d02ce5e0e8742468dc0ab2c9d869d9027f5390299589cc0c
-
SSDEEP
24576:EVAtAQfLY08PFDyKfPVXL5u+gyQQ/hffpLAeMcUg9sB26wn6fbQhPZ:E4dkV54UAkZ
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-