Overview

overview

10

Static

static

Text information.js

windows7_x64

10

Text information.js

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Text information.js

  • Size

    35KB

  • Sample

    210618-ja1cp4sg4x

  • MD5

    51bf52acf5121880a65144f201e60b52

  • SHA1

    091d1c859cbfe1cd0148fdb96fecd08cd55e1428

  • SHA256

    32f9704d37818253fbda931393fe3c1256f37931d0c36539cd20f49100080400

  • SHA512

    bf1328cdb2477edd1d37f43336fe781cea74aee5a431a16698ce685c62aac5f85994dded7226aa53b04d94331e0571e5752f20a6d4d22be4215eab557dba36ea

Score
10/10
doublebackbackdoor

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://golfien.com/client.txt

Targets

    • Target

      Text information.js

    • Size

      35KB

    • MD5

      51bf52acf5121880a65144f201e60b52

    • SHA1

      091d1c859cbfe1cd0148fdb96fecd08cd55e1428

    • SHA256

      32f9704d37818253fbda931393fe3c1256f37931d0c36539cd20f49100080400

    • SHA512

      bf1328cdb2477edd1d37f43336fe781cea74aee5a431a16698ce685c62aac5f85994dded7226aa53b04d94331e0571e5752f20a6d4d22be4215eab557dba36ea

    Score
    10/10
    doublebackbackdoor

    • DoubleBack

      DoubleBack is a modular backdoor first seen in December 2020.

      backdoordoubleback

    • DoubleBack x64 Payload

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks