Analysis
-
max time kernel
105s -
max time network
103s -
platform
windows11-21h2_x64 -
resource
win11-20250410-en -
resource tags
-
submitted
17/04/2025, 10:59
General
-
Target
2025-04-17_b88e18386fecb5bac12683412e06a2e9_black-basta_cobalt-strike_elex_luca-stealer.exe
-
Size
1.8MB
-
MD5
b88e18386fecb5bac12683412e06a2e9
-
SHA1
c78f957bb69c6fb78f9e1e0ad96639e9cf8671ca
-
SHA256
154fc29993c24a2c3729f6f2b47f65dee1e806bdc164fb8eea4d92598c7994c8
-
SHA512
bf3f724d7805ce9a9bb72a107d5b2a3d280d71a21df765188556cf03d07a0e1597e90a42598b33b52d698570dc21455427db0b043a79ad34d16ce9a3c5e3dc2d
-
SSDEEP
49152:JQlRIEqxTzVWhOWqPBILleQCMOOILleQaL:cHqxnAOWNEfk
Malware Config
Extracted
metasploit
windows/shell_reverse_tcp
192.168.233.129:4444
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-04-17_b88e18386fecb5bac12683412e06a2e9_black-basta_cobalt-strike_elex_luca-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2025-04-17_b88e18386fecb5bac12683412e06a2e9_black-basta_cobalt-strike_elex_luca-stealer.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB