Overview

overview

10

Static

static

10

fabb563ea8...d9.exe

windows7-x64

10

fabb563ea8...d9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fabb563ea894000b1a55841f50308d80b36dfc0184888fe5b3923964eaf50cd9

  • Size

    6.4MB

  • MD5

    f5bf57d7444780b3ac51feb31082dbf9

  • SHA1

    f33c619d0ad058fe85d002d2a412aa785c62dd9e

  • SHA256

    fabb563ea894000b1a55841f50308d80b36dfc0184888fe5b3923964eaf50cd9

  • SHA512

    d0813d9c6eceb8091f86f5441d8ad1b735fdaedbd7ada6cc4ad236745ed2eac7d8ae05c335e7f435081276f644b6c918a79b50af31335a3acd7b5401ee32b3d6

  • SSDEEP

    196608:oMJIy9onJ5hrZERSB2WZufOuD9LsKy+IhE9fIWm:JIy9c5hlERW2WmfDZbhIqL

Score
10/10
pyinstallercobaltstrike

Malware Config

Extracted

Family

cobaltstrike

C2

http://192.168.104.38:80/3muH

Attributes
  • user_agent

    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MANM)

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • fabb563ea894000b1a55841f50308d80b36dfc0184888fe5b3923964eaf50cd9
    .exe windows:5 windows x64 arch:x64

    2cdcfb3a828433ba76b5b41f45519bd9


    Headers

    Imports

    Sections

  • payload22.pyc