Overview

overview

10

Static

static

10

2024-05-04...uk.exe

windows7-x64

10

2024-05-04...uk.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2024-05-04_e4123dcd4276f78a171fbf82c9b4ae20_cobalt-strike_ryuk

  • Size

    2.0MB

  • MD5

    e4123dcd4276f78a171fbf82c9b4ae20

  • SHA1

    64807357168926b9392a58105375a143d4cc7c25

  • SHA256

    a9d9b1c2ce5c9fda428667c91a3797fe2010b5590570dc85f9113ccd566c2167

  • SHA512

    31aea10b4215ddb5eab7b45465d406fc561bf5f4980f8fc66cda548b8d8126be9f6b9f45ad9a70bc5b7c261d5bd3868e8e09dfc9eaee25e8c10321017828e390

  • SSDEEP

    24576:9xcwyJruDWLpo8x41jVqu38zMmgwob9L:9xcwyJKDKpo1133bL

Score
10/10
cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

C2

http://101.43.109.204:6666/8Rij

Attributes
  • user_agent

    User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2024-05-04_e4123dcd4276f78a171fbf82c9b4ae20_cobalt-strike_ryuk
    .exe windows:6 windows x64 arch:x64

    e69c514828a4e03d2432bbac7e41e01a


    Headers

    Imports

    Sections