General
- Target 449740d4bcbb92743bf2c64fdecb2e4165639ea68611d0435470688adb328509
- Size 241KB
- Sample260909-hefxmacl9z
- SHA256 449740d4bcbb92743bf2c64fdecb2e4165639ea68611d0435470688adb328509
- MD5 9d08bd516c8f478736d6371ad409f7d5
- SHA1 1df0e76872c4b6a87083ad27cf6d7ac924802fd3
- SHA512 78081c9e42cf987cd0c124f3d8d06b7b72a72d656be9a30ffbcd8b6d95199c8d0f7c3e65db4771b538aab14a8cdea0f28faf1bad64f58b56a70c2126129c19a4
- SSDEEP 3072:iADnSyMCHnfFEPyJae6edpxoA1dyazwhPDYkXR9CPv8KkLTxHxOqlbOehsfFcd6Q:iADnnHnfFBCA1QDlXR9C6LcFR0TYny
- TLSH T121347D4776E559BCE51AC079830695B3B633F88A0620FDBF12E896302F67D511F2CB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
449740d4bcbb92743bf2c64fdecb2e4165639ea68611d0435470688adb328509.exe
Resource
win10v2004-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
449740d4bcbb92743bf2c64fdecb2e4165639ea68611d0435470688adb328509.exe
Resource
win11ltsc2024-20260709-en
1 signatures
150 seconds
Malware Config
Extracted
Family
-
cobaltstrike
C2
-
http://tsundere.ggff.net:8443/download/client/x64
Attributes
-
user_agent
Connection: keep-alive Accept: application/octet-stream Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Targets
-
- Target 449740d4bcbb92743bf2c64fdecb2e4165639ea68611d0435470688adb328509
- Size 241KB
- SHA256 449740d4bcbb92743bf2c64fdecb2e4165639ea68611d0435470688adb328509
- MD5 9d08bd516c8f478736d6371ad409f7d5
- SHA1 1df0e76872c4b6a87083ad27cf6d7ac924802fd3
- SHA512 78081c9e42cf987cd0c124f3d8d06b7b72a72d656be9a30ffbcd8b6d95199c8d0f7c3e65db4771b538aab14a8cdea0f28faf1bad64f58b56a70c2126129c19a4
- SSDEEP 3072:iADnSyMCHnfFEPyJae6edpxoA1dyazwhPDYkXR9CPv8KkLTxHxOqlbOehsfFcd6Q:iADnnHnfFBCA1QDlXR9C6LcFR0TYny
- TLSH T121347D4776E559BCE51AC079830695B3B633F88A0620FDBF12E896302F67D511F2CB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.