Overview

overview

10

Static

static

10

3816c38f5c...0c.dll

windows10-2004-x64

10

3816c38f5c...0c.dll

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    3816c38f5cbe0ee0f02d5db2438700f4f876afbfd57703d8a38ad86ff8d1ec0c
  • Size 50KB
  • Sample260427-e3pb5aew4n
  • SHA256 3816c38f5cbe0ee0f02d5db2438700f4f876afbfd57703d8a38ad86ff8d1ec0c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
trojanbackdoorcobaltstrike

Malware Config

Extracted

Family

  • cobaltstrike

C2

  • http://185.242.233.142:443/jquery-3.3.2.slim.min.js

Attributes
  • user_agent

    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Edg/139.0.0.0

Signatures

  • Family: Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • 3816c38f5cbe0ee0f02d5db2438700f4f876afbfd57703d8a38ad86ff8d1ec0c
    .dll 50KB

3816c38f5cbe0ee0f02d5db2438700f4f876afbfd57703d8a38ad86ff8d1ec0c

  • IMPHASH 07b1628edf16306e47fa626e9220258f
  • SHA256 3816c38f5cbe0ee0f02d5db2438700f4f876afbfd57703d8a38ad86ff8d1ec0c
  • MD5 SHA1 SHA512 SSDEEP TLSH
windows:4windowsx64arch:x64

  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
0
Major OS version
4
Entry point
4912
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL
PDB paths