cobaltstrike | 8fa4bff30b5a304b35f0800e7d34b04c6b06cd2fe2f718e69744c4dc4ea32525

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23-04-2024 08:14

Target

8fa4bff30b5a304b35f0800e7d34b04c6b06cd2fe2f718e69744c4dc4ea32525.exe
Size

19KB
MD5

b477a29dec4654a5feb7e0d41d88870b
SHA1

399104478749ea39dbb99fc0f7f90e8a54ba0c7d
SHA256

8fa4bff30b5a304b35f0800e7d34b04c6b06cd2fe2f718e69744c4dc4ea32525
SHA512

8b4dd7e91569b75637360a4a50a73d3183978e560d4c2006463ac4c4b9b79aa24ecfc52583e50b80f4d26c76995ae8803c413f3d866876feff1810ceed3bfc25
SSDEEP

192:UV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/20SWF8qa1Dojjgi:GqaCF31cix+Dc4zj3FF46gi

Score

10^/10

Family

cobaltstrike

http://192.168.111.130:80/9ycH

Attributes

user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

C:\Users\Admin\AppData\Local\Temp\8fa4bff30b5a304b35f0800e7d34b04c6b06cd2fe2f718e69744c4dc4ea32525.exe
"C:\Users\Admin\AppData\Local\Temp\8fa4bff30b5a304b35f0800e7d34b04c6b06cd2fe2f718e69744c4dc4ea32525.exe"
1⤵
PID:2028

memory/2028-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2028-1-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download