Overview

overview

10

Static

static

10

E88.30_Che...PN.exe

windows10-2004-x64

10

E88.30_Che...PN.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    E88.30_CheckPointVPN.exe

  • Size

    61KB

  • MD5

    c9e06f125bec06a184f50d82659104cc

  • SHA1

    34e8ee115a12efbf6603e9b97bdccaf1e0c69403

  • SHA256

    2bf8594ea21ca101000de7993a55ecdfa5ef34c96b020d87b634ad23a6594d3d

  • SHA512

    d9afb386dfc79ae401c3e8015cd5fdf018bd7f6f5456ca01d5f2bec702fba546133fdcb279cf7aec1163fc108ddb134116f24b127271dfeefdf8da1388adbfe8

  • SSDEEP

    1536:fiarTMDj7EDePNlRMK8yAiIysblda47pcIc6W:qwTMwD0Nl38kIjdaai

Score
10/10
backdoorwarmcookie

Malware Config

Extracted

Family

warmcookie

C2

89.46.232.52

Attributes
  • mutex

    fd3d0df6-f15b-49a5-a53a-276f51809bbd

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0

Signatures

  • Warmcookie family
    warmcookie
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • E88.30_CheckPointVPN.exe
    .exe windows:4 windows x64 arch:x64

    97794dc5ada0320f1618bee762779938


    Headers

    Imports

    Sections