Overview

overview

10

Static

static

10

e79d4d717c...a4.exe

windows7-x64

10

e79d4d717c...a4.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    e79d4d717ca0735d9e97292c7e8e63638d09368518828fbed1a92b9ceb0610a4

  • Size

    63KB

  • MD5

    57ffa93e1dae5c18712b3ecfbf02c0f5

  • SHA1

    a3500465bdbca9189d1c8ba9936d0beedd85c55e

  • SHA256

    e79d4d717ca0735d9e97292c7e8e63638d09368518828fbed1a92b9ceb0610a4

  • SHA512

    c867daa808e7047c7b506911b5df2c6c861c5bdb5e968a4d6df5b6ced65f925864bf7b17b6f010f3b88b832045b39acd008f202a28f7fc07d8cadca0e9dfb15f

  • SSDEEP

    384:FFgJAa8/u2zTFgXPL3eTmySDCJ+LIiMvoRJnnnwNlVlpp5esQfBZr4A89Xu:FFq8Oy/jsVMBp5elBF4A89

Score
10/10
cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

C2

http://shangde.co:2096/jquery-3.3.2.slim.min.js

Attributes
  • user_agent

    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: shangde.co

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • e79d4d717ca0735d9e97292c7e8e63638d09368518828fbed1a92b9ceb0610a4
    .exe windows:6 windows x64 arch:x64

    18d80e58b294ccb3978519230eef5e32


    Headers

    Imports

    Sections