Overview

overview

10

Static

static

run.exe

windows7_x64

10

run.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    run.exe

  • Size

    604KB

  • Sample

    201208-fdm7lkxjnn

  • MD5

    39c2a273de3f1eee2dd6e567a00f1137

  • SHA1

    761c6a1e8506b4bdb84c0f0b2711274e60983033

  • SHA256

    fa87c7714331280fcceb6bbcf23834dc2b1d66ad2589a7513a16d205df0db509

  • SHA512

    4acc948705fc972c675d5190ed8a4b7ee1be174f617134b03ac043a525de2c9f6cb1fee7b0af3fa217135693ba006f8ca3f32ee7218af06117b5ea963f29cf12

Score
10/10
cobaltstrikebackdoortrojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://NuQuiedi8ezai5aHucei.cantusethis.fun:443/image/

http://Jae3Faita9jeiMeiVeiv.cantusethis.site:443/gifs/

http://ibee3sahkei7Ohcu9uGi.cantusethis.online:443/image/
Attributes
  • access_type

    512

  • beacon_type

    2048

  • dns_idle

    6.7373064e+07

  • dns_sleep

    8.1297408e+08

  • host

    NuQuiedi8ezai5aHucei.cantusethis.fun,/image/,Jae3Faita9jeiMeiVeiv.cantusethis.site,/gifs/,ibee3sahkei7Ohcu9uGi.cantusethis.online,/image/

  • http_header1

    AAAACgAAAB9BY2NlcHQtTGFuZ3VhZ2U6IGVuLVVTLGVuO3E9MC41AAAACgAAAFJBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LGltYWdlL3dlYnAsKi8qO3E9MC44AAAACgAAAB5BY2NlcHQtRW5jb2Rpbmc6IGd6aXAsIGRlZmxhdGUAAAAKAAAAEUNvbm5lY3Rpb246IGNsb3NlAAAABwAAAAAAAAAPAAAADQAAAAEAAAALL2tpdHRlbi5naWYAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAAB5Db250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL2pzb24AAAAKAAAAEUNvbm5lY3Rpb246IGNsb3NlAAAABwAAAAAAAAAPAAAACAAAAAYAAAAOQXV0aGVudGljYXRpb24AAAAHAAAAAQAAAAMAAAACAAAAc3siaW1hZ2VfdXJsIiA6ICJodHRwczovL3N1bjktMjMudXNlcmFwaS5jb20vRzRKdmRaREVmTGRJUGxOTjEtSmtNR1EydW5mMktFSVY1NE9tNWcvYWJKNzBqR0hmVmsuanBnIiwgIm1ldGFkYXRhIiA6ICIAAAABAAAAAiJ9AAAABAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    5120

  • maxdns

    235

  • polling_time

    60000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\dfrgui.exe

  • sc_process64

    %windir%\sysnative\dfrgui.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCWJolZfZtN4+W4l2naPtrRPBZ9E6XqVyL8XSC08vwYVEtmn7iwPUgBQsddprki6QXEuQUro5OTw+ESzZzNrgOimS9DSimgnM8DroKyW8tQQgiPNHvIWyix4+fH7Ps7uEwr3o1nqPhEQHXYhmsHU/q73G6OxBHNR+OQDKaVgAg5bwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    3.2384e+09

  • unknown2

    AAAABAAAAAIAAABAAAAAAgAAAEAAAAACAAAAQAAAAAIAAABAAAAAAgAAAEAAAAACAAAAQAAAAAIAAABAAAAAAgAAAEAAAAACAAAAQAAAAAIAAABAAAAAAgAAAEAAAAACAAAAQAAAAAIAAABAAAAAAgAAAEAAAAACAAAAQAAAAAIAAABAAAAAAgAAAEAAAAACAAAAQAAAAAIAAABAAAAAAgAAAEAAAAACAAAAQAAAAAIAAABAAAAAAgAAAEAAAAACAAAAQAAAAAIAAABAAAAAAgAAAEAAAAACAAAAQAAAAAIAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /temp/

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Safari/537.36

Targets

    • Target

      run.exe

    • Size

      604KB

    • MD5

      39c2a273de3f1eee2dd6e567a00f1137

    • SHA1

      761c6a1e8506b4bdb84c0f0b2711274e60983033

    • SHA256

      fa87c7714331280fcceb6bbcf23834dc2b1d66ad2589a7513a16d205df0db509

    • SHA512

      4acc948705fc972c675d5190ed8a4b7ee1be174f617134b03ac043a525de2c9f6cb1fee7b0af3fa217135693ba006f8ca3f32ee7218af06117b5ea963f29cf12

    Score
    10/10
    cobaltstrikebackdoortrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks