Overview

overview

10

Static

static

10

2024-05-03...uk.exe

windows7-x64

1

2024-05-03...uk.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2024-05-03_e013cc02c1a63928e618d9d397cdebd6_cobalt-strike_ryuk

  • Size

    225KB

  • MD5

    e013cc02c1a63928e618d9d397cdebd6

  • SHA1

    2b8827d9c286c9b9fda3786a1d59d0065b368b77

  • SHA256

    acf646339f5ff5418dfc8a4ba3a5fda57ad714e54a7326d61392fe92cea0392b

  • SHA512

    b502cad60eb084db0603aa38bf3d3e8ca9bd715c303ae466f775bfc50ec6a57b0ddb50caa224cc8caecdcfd3791b8c96ea0a0556a37a894ea85720a54c832961

  • SSDEEP

    3072:2BjTmkU2NkcQh8SFYkj5sGdo/ALZINY6lAQRasbsyzoY46LdUClMFlJEg:2BwYkqSO05sCo/A7CohgSvEg

Score
10/10
cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

C2

http://101.43.109.204:6666/Gn8p

Attributes
  • user_agent

    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E)

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2024-05-03_e013cc02c1a63928e618d9d397cdebd6_cobalt-strike_ryuk
    .exe windows:6 windows x64 arch:x64

    49fb40ae6bd57f38532a296395059ebe


    Headers

    Imports

    Sections