Overview

overview

10

Static

static

10

2024-07-26...ch.exe

windows7-x64

1

2024-07-26...ch.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    2024-07-26_bc7eb6a7a00550cf22e8c5756162a066_cobalt-strike_poet-rat_snatch

  • Size

    19.0MB

  • MD5

    bc7eb6a7a00550cf22e8c5756162a066

  • SHA1

    c80705882ba4ae16901686efacecbd3d7b522c43

  • SHA256

    546b074e0f9b257dba0c7739f18497a8c9ca7fdb892aa3c1bcc7c06c4bb816d6

  • SHA512

    695d34c19398bdf994970546dd612f9add4beb6a2ebb57ba783813b9efc4dbb5b7eafec307c264b2dff734ca536c09f71b8954191f47f195e2afc58da291cbff

  • SSDEEP

    98304:waoHJypyHxIdwZ/FDDEs5nQ8gDpIcakkLlO4R96EBPU5EAV+Iht4mtYyR9CztUAx:B2Jad4As4DpIBv8a4+I4S0WADpH

Score
10/10
cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

C2

http://165.154.33.10:3333/XXXXXX

Attributes
  • user_agent

    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2024-07-26_bc7eb6a7a00550cf22e8c5756162a066_cobalt-strike_poet-rat_snatch
    .exe windows:6 windows x64 arch:x64

    ea509d361799935a94335b88f534a970


    Headers

    Imports

    Sections