afb18a857ff2943fad1630fbe01f04ce32bb2d8a566c59d4c1dd40bd717df759 | Triage™

Login
Reports

Overview

overview

7

Static

static

3

2026-07-30...ti.exe

windows10-2004-x64

7

2026-07-30...ti.exe

windows11-ltsc_2024-x64

7

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_d42d362425d038f0f5adad9427224e3b_cobalt-strike_conti
Size 280KB
Sample260730-hhmvcael8t
SHA256 afb18a857ff2943fad1630fbe01f04ce32bb2d8a566c59d4c1dd40bd717df759
MD5 d42d362425d038f0f5adad9427224e3b
SHA1 9b0588188a7de3607ba6ab5c69e0278215e627ed
SHA512 e3b67beafa2a57ec39c68f33c1a294a590913efe4f72e5a99ba3d2c698b792e654ccde6369d144d34ec0bb6862416385c0409022356cc5735dc19d281d6e608c
SSDEEP 6144:2zEY8rMfFSkGd5d8tMfsXfjyKsZ3WTDUMpjOZfN:82wfY/tHKSOU
TLSH
T1C2545D2AB36354FDC657817593DB93B1D932FC210360AA6F1B95CF323E5ACA00B5EA14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

2026-07-30_d42d362425d038f0f5adad9427224e3b_cobalt-strike_conti.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

10 signatures

150 seconds

discovery execution persistence

Behavioral task

behavioral2

Sample

2026-07-30_d42d362425d038f0f5adad9427224e3b_cobalt-strike_conti.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

9 signatures

150 seconds

discovery execution persistence

Malware Config

Targets

- Target
  2026-07-30_d42d362425d038f0f5adad9427224e3b_cobalt-strike_conti
- Size 280KB
- SHA256 afb18a857ff2943fad1630fbe01f04ce32bb2d8a566c59d4c1dd40bd717df759
- MD5 d42d362425d038f0f5adad9427224e3b
- SHA1 9b0588188a7de3607ba6ab5c69e0278215e627ed
- SHA512 e3b67beafa2a57ec39c68f33c1a294a590913efe4f72e5a99ba3d2c698b792e654ccde6369d144d34ec0bb6862416385c0409022356cc5735dc19d281d6e608c
- SSDEEP 6144:2zEY8rMfFSkGd5d8tMfsXfjyKsZ3WTDUMpjOZfN:82wfY/tHKSOU
- TLSH
  T1C2545D2AB36354FDC657817593DB93B1D932FC210360AA6F1B95CF323E5ACA00B5EA14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryexecutionpersistence

behavioral2

discoveryexecutionpersistence

© 2018-2026

Terms | Privacy