Overview

overview

10

Static

static

und_khjckj...ajk.js

windows7-x64

10

und_khjckj...ajk.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    und_khjckjhadkjhajk.js

  • Size

    205KB

  • Sample

    220917-1c8hzaacf3

  • MD5

    1631086ce2efffca6ffab9ae97b8f3ff

  • SHA1

    75ca403dd06a741af86b109c0b720d33c0af4b71

  • SHA256

    5bfdb3c2a9763232dde5f3fce4646d7688fe1f70598ca94fa13c29a1c7273510

  • SHA512

    ced54d2e3d99218e3b3024dce627e495a6f688a41580cd1bfcb14bb9ea5c1614a3516fbb27bac284bc2fd618cd912a859326f3e839ddeceb2ebbe7cab8511254

  • SSDEEP

    1536:bMycn+Pnt5GgJSgMvaUrFSb5ydyjJnmnHcAS1W+8B2PCAfF4CDGMlEzIqyrCAiFO:oyc+HvJSgQfSbnm+16QyCOUhD4PhWICJ

Score
10/10
asyncratcobaltstrikebackdoorpersistencerattrojan

Malware Config

Targets

    • Target

      und_khjckjhadkjhajk.js

    • Size

      205KB

    • MD5

      1631086ce2efffca6ffab9ae97b8f3ff

    • SHA1

      75ca403dd06a741af86b109c0b720d33c0af4b71

    • SHA256

      5bfdb3c2a9763232dde5f3fce4646d7688fe1f70598ca94fa13c29a1c7273510

    • SHA512

      ced54d2e3d99218e3b3024dce627e495a6f688a41580cd1bfcb14bb9ea5c1614a3516fbb27bac284bc2fd618cd912a859326f3e839ddeceb2ebbe7cab8511254

    • SSDEEP

      1536:bMycn+Pnt5GgJSgMvaUrFSb5ydyjJnmnHcAS1W+8B2PCAfF4CDGMlEzIqyrCAiFO:oyc+HvJSgQfSbnm+16QyCOUhD4PhWICJ

    Score
    10/10
    asyncratpersistenceratcobaltstrikebackdoortrojan

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks