Overview

overview

10

Static

static

7681e4fc87...55.exe

windows7_x64

10

7681e4fc87...55.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7681e4fc876248e697155c21dc2e57efe91240ed6e2204d011b4cf19e944f555.7z

  • Size

    127KB

  • Sample

    220119-w2vaesccf7

  • MD5

    3f7c2868f762b3d97de2dbd5473ad49d

  • SHA1

    ec9e26fa72e39b933eea4bc3932f072caa32a85c

  • SHA256

    ab80ac104b07868057d43090356c52d64c20680f54837658acd7ff765ac2c0ac

  • SHA512

    3b235100f9a0c426c31772d7421b872509124164afe02899f276f079ad8ec9a09d5e8bf89bf8ac1fb80b7b01355fd7b1348c2d4518eab53b888abbabc8d93554

Score
10/10
cobaltstrike884681473backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

884681473

C2

http://chat.myunitedhealth.care:443/jquery-3.3.1.min.js

http://52.42.45.200:443/jquery-3.3.1.min.js
Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    chat.myunitedhealth.care,/jquery-3.3.1.min.js,52.42.45.200,/jquery-3.3.1.min.js

  • http_header1

    AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAABAAAAAVSG9zdDogY29kZS5qcXVlcnkuY29tAAAACgAAACBSZWZlcmVyOiBodHRwOi8vY29kZS5qcXVlcnkuY29tLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAANAAAAAgAAAAlfX2NmZHVpZD0AAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAABAAAAAVSG9zdDogY29kZS5qcXVlcnkuY29tAAAACgAAACBSZWZlcmVyOiBodHRwOi8vY29kZS5qcXVlcnkuY29tLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAAPAAAADQAAAAUAAAAIX19jZmR1aWQAAAAHAAAAAQAAAA8AAAANAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    9472

  • polling_time

    60000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\upnpcont.exe

  • sc_process64

    %windir%\sysnative\upnpcont.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCYchyLQ390jTBDWxFkIx9EnLJCYoo8DkF8WZX8364ivoucy6yGAwHYFH2v8QGOtRf21RKRjHG271Etr6ZRuY0lrvrRu0vRmllHGBejWv9Pi4tWqHIo2r9ldwQOq1SRvYZcBwNpFb66kVZezmb7BKVPnZTZm6Ke6BCo9I3YRCn0yQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4.234810624e+09

  • unknown2

    AAAABAAAAAEAAAXyAAAAAgAAAFQAAAACAAAPWwAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /jquery-3.3.2.min.js

  • user_agent

    Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

  • watermark

    884681473

Targets

    • Target

      7681e4fc876248e697155c21dc2e57efe91240ed6e2204d011b4cf19e944f555

    • Size

      278KB

    • MD5

      08ac638554e15c938dc418945e536287

    • SHA1

      4fe0426acd2a1e1237a664644b46011e3f86a0dc

    • SHA256

      7681e4fc876248e697155c21dc2e57efe91240ed6e2204d011b4cf19e944f555

    • SHA512

      e0ab944b1a8ae75ff647e9088edb432b8f07b75d01443eeabd8f591cf7443987d1fb54170d32b7cf5a8549e3fc4bbc096b8adc7fb9415de26e21b88f38e1890d

    Score
    10/10
    cobaltstrikebackdoortrojan884681473
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks