Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/10/2024, 01:25
General
-
Target
2024-10-18_8025e69a6f4542b510040e9188847b90_cobalt-strike_hijackloader_megazord_poet-rat.exe
-
Size
46.2MB
-
MD5
8025e69a6f4542b510040e9188847b90
-
SHA1
93d6ed797587b824e15299cf96a0cced6d4cba3d
-
SHA256
4af8a3231cf8ef4c201ec112d2834bbed7d9155bf4035597e84be60a0d4576cc
-
SHA512
5943bc255bd7f8b69644a5ce730d87f64c6e1011fe5f6d9596cbc71f9b9de4755501ff7bc398f03cbd272b7caa4d51ccc97b683c261de29ab2154e619c701369
-
SSDEEP
196608:HCJfrFyrm3hgLYAVuSnGnhOg0B3s4VuaXemGMtS6pzNWYA5+47WVXebdx7VbVTiB:i9rYq3hg8ThNSfM75+464ZpTbyMyzU6
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-18_8025e69a6f4542b510040e9188847b90_cobalt-strike_hijackloader_megazord_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-18_8025e69a6f4542b510040e9188847b90_cobalt-strike_hijackloader_megazord_poet-rat.exe"1⤵
- Checks computer location settings