General
-
Target
f0b632dfee0b9b66b8a3709c564802c6ec1c9b4645c160ffdfd996123c5ddc78.exe
-
Size
59KB
-
Sample
241122-29745ssjay
-
MD5
c71c3b1e9f10a12e3ef427a8a9b21f60
-
SHA1
9731c2e5f83876048f0492c2cdcab62233947e1b
-
SHA256
f0b632dfee0b9b66b8a3709c564802c6ec1c9b4645c160ffdfd996123c5ddc78
-
SHA512
91e0d0130d53ac81f6975fbe3fc8d97d3d3b304b4f29ea03d7b190e61ea3e2bbe60a1fcac1f2083198e26fbca8e3961e01a311b2330b1c20f8ceac65e1a715bc
-
SSDEEP
768:KdEjJzLNnzTQlZ3v51ExQ2ytSCFGfGnD3CK59eL4kZAHyR8BkNYJ3840pL77BTho:KdkzB0lZvTnrCK59eL4kZAcPNYeLrEpH
Malware Config
Extracted
cobaltstrike
http://47.103.116.103:443/jquery-2.3.2.min.js
-
user_agent
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Host: code.jquery.com Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Targets
-
-
Target
f0b632dfee0b9b66b8a3709c564802c6ec1c9b4645c160ffdfd996123c5ddc78.exe
-
Size
59KB
-
MD5
c71c3b1e9f10a12e3ef427a8a9b21f60
-
SHA1
9731c2e5f83876048f0492c2cdcab62233947e1b
-
SHA256
f0b632dfee0b9b66b8a3709c564802c6ec1c9b4645c160ffdfd996123c5ddc78
-
SHA512
91e0d0130d53ac81f6975fbe3fc8d97d3d3b304b4f29ea03d7b190e61ea3e2bbe60a1fcac1f2083198e26fbca8e3961e01a311b2330b1c20f8ceac65e1a715bc
-
SSDEEP
768:KdEjJzLNnzTQlZ3v51ExQ2ytSCFGfGnD3CK59eL4kZAHyR8BkNYJ3840pL77BTho:KdkzB0lZvTnrCK59eL4kZAcPNYeLrEpH
Score10/10-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-