Analysis
-
max time kernel
105s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
28/03/2025, 22:31
General
-
Target
2025-03-28_d12d8d03a4b7c35686a28c6a401d2de7_amadey_cobalt-strike_cobaltstrike_poet-rat_sliver_smoke-loader_snatch.exe
-
Size
5.1MB
-
MD5
d12d8d03a4b7c35686a28c6a401d2de7
-
SHA1
9e0ba732d321755a0b04615c1dff0b71b24268ed
-
SHA256
5c41ec6dff6bc0c6a3f118d7991b7eedbbbd00a33484a97ca95e5c362690400d
-
SHA512
82fc685e04911536f16ec131ad409d2bda05807341ca47293708ccc81e5e9465ab125bad966aadfb102bf222870f0a09db81530264b76c1ace9bd32a737b5911
-
SSDEEP
49152:r56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6liK1uOCeXvpnz:r56utgpPFotBER/mQ32lUR
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-28_d12d8d03a4b7c35686a28c6a401d2de7_amadey_cobalt-strike_cobaltstrike_poet-rat_sliver_smoke-loader_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-28_d12d8d03a4b7c35686a28c6a401d2de7_amadey_cobalt-strike_cobaltstrike_poet-rat_sliver_smoke-loader_snatch.exe"1⤵
- System Location Discovery: System Language Discovery