cobaltstrike | 52470c44e9adb46b079991326ff14f613d082bafa2b0080c42001dd0cd7182f4

Analysis

max time kernel
143s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 03:07

Target

52470c44e9adb46b079991326ff14f613d082bafa2b0080c42001dd0cd7182f4.exe
Size

19KB
MD5

06e4275ea1dd2498f0ff217b957659ef
SHA1

a35ff2dfe5c25f67d93e944f550ddfc03f5f99a0
SHA256

52470c44e9adb46b079991326ff14f613d082bafa2b0080c42001dd0cd7182f4
SHA512

11f7e61df047ff9fcd0e41fe2007d25a0ec169e7475933ac9e80a22c724e5ba340be1ada2f9d3d963261e3a28e62b818d70826662cfcd6b706f8bd29a0bc9d52
SSDEEP

192:hV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2rXn0GcWF8qa1Dojjgi:zqaCF31cix+Dc4zjorFF46gi

Score

10^/10

Family

cobaltstrike

http://104.21.13.64:8080/A5ny

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows Phone OS 7.5; Trident/5.0; IEMobile/9.0; LG; LG-E906) Host: www.ssdzf.life:8080

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

C:\Users\Admin\AppData\Local\Temp\52470c44e9adb46b079991326ff14f613d082bafa2b0080c42001dd0cd7182f4.exe
"C:\Users\Admin\AppData\Local\Temp\52470c44e9adb46b079991326ff14f613d082bafa2b0080c42001dd0cd7182f4.exe"
1⤵
PID:2444

memory/2444-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2444-1-0x0000000003C30000-0x0000000004030000-memory.dmp

Filesize
4.0MB

Download
memory/2444-2-0x00000000023E0000-0x0000000002436000-memory.dmp

Filesize
344KB

Download
memory/2444-3-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2444-5-0x00000000023E0000-0x0000000002436000-memory.dmp

Filesize
344KB

Download