Extracted

• • Target

    49f0cdb4cb8c7c0f2ea2a0f88f1802d8788d949ae7e3be5bda31b03a2be9cb04.exe

  • Size

    1.1MB

  • MD5

    b24a83c233c1779de6c84ac023e091c3

  • SHA1

    1a00dbe47fa6cd9aa5a0564089bef5654f1fd7bb

  • SHA256

    49f0cdb4cb8c7c0f2ea2a0f88f1802d8788d949ae7e3be5bda31b03a2be9cb04

  • SHA512

    423c9dc882b0737ee7833f449ac1a6663d91858ff1b3922e511dc738a0eeb8ee034a761601e82b62e03f7b867efd2a7b8a491dac4f06dde1ea458cd88040314f

  • SSDEEP

    12288:qBcVkHD+Mb90JxQR9sBtylhFqNBHx+kiXhEZ9BB9xDTgLeJIJ:KD+Mb90JxQR6BolhYrx+g9BjJO

  Score

  10^/10

  cobaltstrikebackdoortrojanpersistence

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Cobaltstrike family

    cobaltstrike

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2