Overview

overview

10

Static

static

2022 ?????...??.pdf

windows7-x64

1

2022 ?????...??.pdf

windows10-2004-x64

1

??????????....6.exe

windows7-x64

10

??????????....6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a9a8a161ab82517e835371ded48d119de5e532aaa8ad5d3d717436ce90149937

  • Size

    710KB

  • Sample

    220808-nbczfshhdj

  • MD5

    442a39524955dfbaa1ceea4dee3b93c6

  • SHA1

    eeac9d0b6233282a17b69d3ae538719cd880616c

  • SHA256

    a9a8a161ab82517e835371ded48d119de5e532aaa8ad5d3d717436ce90149937

  • SHA512

    62d2d98d828f7e9569052b7ce8d3e42f9fe7e9b8941e70ae35d6392d4d434dd0caa69326df9b969ebcc68bb63e25eded59cbe6840743306b7085dfa833ca7a27

Score
10/10
cobaltstrike1backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

1

C2

http://service-4j8u5xfz-1313036808.sh.apigw.tencentcs.com:443/passApi/html/_blank.html

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    service-4j8u5xfz-1313036808.sh.apigw.tencentcs.com,/passApi/html/_blank.html

  • http_header1

    AAAACgAAABxVcGdyYWRlLUluc2VjdXJlLVJlcXVlc3RzOiAxAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAAAAAAADQAAAAIAAAAFQU5JRD0AAAACAAAAGV9fU2VjdXJlLTNQQVBJU0lEPW5vc2tpbjsAAAABAAAAIztDT05TRU5UPVlFUytDTi56aC1DTisyMDIxMDkxNy0wOS0wAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IHRleHQvcGxhaW47Y2hhcnNldD1VVEYtOAAAAAoAAAAvQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQAAAAKAAAAGENhY2hlLUNvbnRyb2w6IG1heC1hZ2U9MAAAAAoAAAAfUmVmZXJlcjogaHR0cHM6Ly93d3cuYmFpZHUuY29tLwAAAAoAAAAcVXBncmFkZS1JbnNlY3VyZS1SZXF1ZXN0czogMQAAAAcAAAAAAAAADQAAAAUAAAAIX19mb3JtaWQAAAAJAAAADmFwX2lkPWZrc2RVZEdXAAAACQAAABluZXdidXllcm5hbWU9bWJkWlNnSnZFR3BpAAAACQAAABZmaWVsZG5hbWU9RnNMS25hQ3VCdmVvAAAABwAAAAEAAAANAAAAAgAAAClhaWRfPTAwMDAwMDAwJmFjY3Zlcj0xJnNob3d0eXBlPWVtYmVkJnVhPQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    4864

  • polling_time

    23000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\gpupdate.exe

  • sc_process64

    %windir%\sysnative\gpupdate.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCsEmxfKMYC5LiUpKEMysDw5RhiFkIv7c6+EWluHiIuCfVd7tNDkMPj+o8rkg7TnhFLVceHaB33aSx/h0YQXJ6QLAldtmRN6iAYB+cfGhE/9B2LEllnHXyBEUiNoki/qP1JVMO8ohGBGMcGOWPgmPfkDthg0ObBvGVfzzXST0PX1wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    1.481970944e+09

  • unknown2

    AAAABAAAAAEAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /v2/api/

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36

  • watermark

    1

Targets

    • Target

      2022 ??????????????.pdf

    • Size

      414KB

    • MD5

      f326e76cf53e4ec870e3f01a44fcd2c8

    • SHA1

      c429301ea04fbe29413280095dfad6c1faedce9b

    • SHA256

      e0c93b9928653a0bd65f68869dbc4832ca6f8d04392df893fcf54e41b2f323b2

    • SHA512

      04a6fa3a7f6a2030f0cafef12643e078918b77a8dcd0298848d231161f6c60ff8e64b892f061892567187a7ca6d042f1a60f09873fe01f5aad142055812a5865

    Score
    1/10
    behavioral1behavioral2

    • Target

      ?????????? Bate v0.1.0.2.103.6.exe

    • Size

      412KB

    • MD5

      91154a4d0b7bacfd53525a66a932f3fe

    • SHA1

      9971101161b734ada1230f39879ef18406189ff2

    • SHA256

      c01f48fd972e6d2eb3e54806db58191384ae33dc31c3470b624e44734c6024cb

    • SHA512

      523980b7f8d43b482f2346f61a8698a9f1b85d6ebae46e43ab3d94a48ed893b67ae8fea37053f4c948617a2e618acfa096314f7efc5d90f4eb606c4799c6b697

    Score
    10/10
    cobaltstrike1backdoortrojan
    behavioral3behavioral4

MITRE ATT&CK Enterprise v6

Tasks