General
- Target 4e03ff7654cc58b148cfee57ba8da6e23ceaa80b9736695c85003052ceafbf7d
- Size 20KB
- Sample260821-mesnmsstf1
- SHA256 4e03ff7654cc58b148cfee57ba8da6e23ceaa80b9736695c85003052ceafbf7d
- MD5 e4d85a492483dc7e6af5b4bc32fddffa
- SHA1 0204be429a8dac9d2a993f45101987cdc391acb8
- SHA512 e7b87bc4bd160b366c83da2c5d1b69aaa419eaf63239d99457d4246e65a021f9b16661bf02b5fd097f8919299203fadace6dd3bc9e5093215d0a8bf2cb40653f
- SSDEEP 384:hGDAptIkR0QKNsktFRxRwyQ347r7AtQ9+yfxzwcB1FfZeSTG5fhPgGh8Nlozjwmm:U0pt7q3jxayQ3CrkRyfxzwcBUEGElE8D
- TLSH T16DA2E1BC734A5D0FF57126192982C30CE37562886B1B3A90F76E361C5EBCC16EC9C650
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
artifact2_x64.exe
Resource
win10v2004-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
artifact2_x64.exe
Resource
win11ltsc2024-20260709-en
1 signatures
150 seconds
Malware Config
Extracted
Family
-
cobaltstrike
C2
-
http://103.54.153.49:80/XQCq
Attributes
-
user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2; .NET4.0C)
Targets
-
- Target artifact2_x64.exe
- Size 40KB
- SHA256 24e0082d1a5c13b2854d7cdd3ab724cf8f8c1af83b262aeb0a1540268efe7bb4
- MD5 8073551556ffa7a02186fa8b7ff386a8
- SHA1 96cecef037e2f3f920716192f7bbc8f342ca62e5
- SHA512 dc4cac99f3eea21010202eeae6e0bbf3c924507c7c7975e267d8e2bcfd537577d21771be1d1d0249380d24c119995990342a70c8297d006d3fe721c190d525cc
- SSDEEP 768:rHOwsh/RE8KX002s+j8Rx0bUNAOXNUVhuvL1b2qZ6PXTzI:otBsis8oNpN+cvLRwPjz
- TLSH T192133B6EA34364ECD20BD27846EB6733BC31FC634160DE7F16A4E6701E11E516B2AA34
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.