Overview

overview

10

Static

static

903dbd72c1...84.exe

windows7_x64

10

903dbd72c1...84.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    903dbd72c1732e86c04836468cca542a83a118b17a1767b02c2137059210df84

  • Size

    15KB

  • Sample

    220708-weld1achbp

  • MD5

    c41a4cb7f0043990da075f222ecbc33d

  • SHA1

    580d88e2e503322c259c93dcbd2052e5c8cae0d7

  • SHA256

    903dbd72c1732e86c04836468cca542a83a118b17a1767b02c2137059210df84

  • SHA512

    ee6202b44c34961dc3f14e00a4bd94fcbd36268852786440cdd530f32be40c3937a601751f580592fca8cf9ffe4ddb3ec928df5e3d53e7435d24c6ad643186aa

Score
10/10
cobaltstrikebackdoortrojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://192.168.0.102:8080/p2uF

Attributes
  • user_agent

    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;PTBR)

Targets

    • Target

      903dbd72c1732e86c04836468cca542a83a118b17a1767b02c2137059210df84

    • Size

      15KB

    • MD5

      c41a4cb7f0043990da075f222ecbc33d

    • SHA1

      580d88e2e503322c259c93dcbd2052e5c8cae0d7

    • SHA256

      903dbd72c1732e86c04836468cca542a83a118b17a1767b02c2137059210df84

    • SHA512

      ee6202b44c34961dc3f14e00a4bd94fcbd36268852786440cdd530f32be40c3937a601751f580592fca8cf9ffe4ddb3ec928df5e3d53e7435d24c6ad643186aa

    Score
    10/10
    cobaltstrikebackdoortrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks