Extracted

• • Target

    37b7ef0d4d00b99958084264802d6678f1993b8d4a6ed968f56333f3690d85b5

  • Size

    739KB

  • MD5

    af2a542f54000577664f54e2218b2283

  • SHA1

    9b4e6ebc5426a6cfde433f7a001d70b12d202dc2

  • SHA256

    37b7ef0d4d00b99958084264802d6678f1993b8d4a6ed968f56333f3690d85b5

  • SHA512

    dfa485ede593451671b5fa6de7490efa7f4c1a8d9bd10f838304e6873156b37372a4ac5c4c60615d1b3cc3ca32bac3f75bdf3834eed617bd764fbb9a7d3f5c3e

  • SSDEEP

    12288:ICQjgAtAHM+vetZxF5EWry8AJGy0UbpJbxjF1jAaGY1lNBuv+ob9vGvXCy1:I5ZWs+OZVEWry8AFZdvFH1lN8vLb9+vN

  Score

  10^/10

  cobaltstrikebackdoordiscoverytrojan

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Cobaltstrike family

    cobaltstrike

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2