Overview

overview

10

Static

static

10

68b9ddb424...d8.exe

windows7-x64

1

68b9ddb424...d8.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    68b9ddb424e2521387e673f1ac48bef8c5e3e8685467464e2b9eae59dbc2b4d8

  • Size

    1.9MB

  • MD5

    17bda10f370a8c3bb8c6130150edaedf

  • SHA1

    b246b7b217c878bbe6a8d74c0c0b75a02131d529

  • SHA256

    68b9ddb424e2521387e673f1ac48bef8c5e3e8685467464e2b9eae59dbc2b4d8

  • SHA512

    495a06f3da181b87183617c2c887ea193ddae646dc525333a32633e803708a88f1a113f0c6e3a4837cc95f6a810b99e0b47de5b702313c172de058a4bcd99ad1

  • SSDEEP

    24576:IqMNxvtMVngDBWgV6XPYh8rgwItCZ3eOZpD1JBgKrGBmvQWbAwjwzkuk2a:ITN1tMVgDUIehgwIwnpD1r1WNzY1

Score
10/10
cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

C2

http://124.221.203.56:22443/jquery-3.3.2.slim.min.js

Attributes
  • user_agent

    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 68b9ddb424e2521387e673f1ac48bef8c5e3e8685467464e2b9eae59dbc2b4d8
    .exe windows:6 windows x64 arch:x64

    9cbefe68f395e67356e2a5d8d1b285c0


    Headers

    Imports

    Sections