Suspicious ^85% Download

a1fef72ee40c92802a713f095c00cf9afc4ef5175ce1b57eca7f638d0f4fa85c.unknown

Cobalt Strike beacon detected

Detects CobaltStrike C2 encoded profile configurationDetects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.

SHA-256a1fef72ee40c92802a713f095c00cf9afc4ef5175ce1b57eca7f638d0f4fa85c

MaleculeMdTh

Evidence

Encoded payload detected: xor line 153023

153023FQQLQ.)##q.)bMBSSOJ@BWJLMKBPNBGFBMBWWFNSWWLOLBGWKF`QVMWJNFOJAQBQZJM@LQQF@WOZ
)sOFBPF@LMWB@WWKFBSSOJ@BWJLMPPVSSLQWWFBNELQNLQFJMELQNBWJLM
.)######q.)bWWFNSWWLVPFnpjo@LGFEQLNWKJPBPPFNAOZGVQJMDMBWJUF@LGFJMJWJBOJYBWJLM)wKJPJMGJ@BWFPBAVDJMZLVQBSSOJ@BWJLM
jWJPNLPWOJHFOZWKFQFPVOWLE@BOO

Encoded payload detected: xor → base64 line 157556

157556FtFGwKVeQJpBW###iBMeFAnBQbSQnBZiVMiVObVDpFSl@WmLUgF@####QJIMGBFO####�V!3%#

Identifies XOR'd strings used in Cobalt Strike Beacon DLL line 178032

178032F###PZPWFN####PBPPPG#QA##V##PP###
	#	##g**GGGGGG*P)##

Detects CobaltStrike C2 encoded profile configuration line 196104

196104[###}"##�"##s�!3






]


	
�0
	

	
x�

Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key. line 196928

196928

*




@bwdaal"8#=-%Zdcibz~-CY-<=#=6-Zdc;96-u;9$-L