Overview

overview

10

Static

static

10

2024-05-04...uk.exe

windows7-x64

10

2024-05-04...uk.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-05-04_98230f1c6c8c079bd62aa67602055f0b_cobalt-strike_ryuk

  • Size

    2.0MB

  • MD5

    98230f1c6c8c079bd62aa67602055f0b

  • SHA1

    c27f894bfe92bc8489b11335509a01b6085e884f

  • SHA256

    a510fbecec88f90d684f9ca9a036ac190d84f6c1e3341cabe9bb261d4f85a1b0

  • SHA512

    cb307c81b33c1ed50dfb99e1e0793fae249d11ee1c1c9cc72991f7b6c7b303d020c927147dc740d50ab53d568d9157c4ddfbec120518fec5f53dd8994dfa5762

  • SSDEEP

    24576:PJOt+7a4QSTSu588RAe3dPEg4KM2HHikAKsWx:PJOt+7USTSuke3dPn4z2iq

Score
10/10
cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

C2

http://101.43.109.204:6666/8Rij

Attributes
  • user_agent

    User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2024-05-04_98230f1c6c8c079bd62aa67602055f0b_cobalt-strike_ryuk
    .exe windows:6 windows x64 arch:x64

    92a789baf24324c59ce8ba5c15cbf7c8


    Headers

    Imports

    Sections