Overview

overview

10

Static

static

12baff892d...b3.exe

windows7-x64

10

12baff892d...b3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    12baff892dc37e78e427790d4a41ab84df33309db3b54f2b9f75bb31644c30b3

  • Size

    312KB

  • Sample

    221126-apv6ashd46

  • MD5

    6f123e6d33cc280d6138bdf61490bd9d

  • SHA1

    230459646d4c8985409879520eb88eaf698a5689

  • SHA256

    12baff892dc37e78e427790d4a41ab84df33309db3b54f2b9f75bb31644c30b3

  • SHA512

    cfbe9e7ff481b820f9fcf2694b1f5d2aceab9c6a01072bd13fd2bdf1f471e2b9bd4eaafb2566b0d795ce62ed1e7245e045640a7df1435fe1a86bc000ef9c64e7

  • SSDEEP

    6144:0yAaQ1BdglcE19mMOJ64SszizGMWS9QcCeLZrdIC0wPysIeN20fu59Bdvka:0yAR1Boc2mMOJYszizPxVCIPpysIG20C

Score
10/10
cobaltstrikebackdoorbootkitpersistencetrojan

Malware Config

Targets

    • Target

      12baff892dc37e78e427790d4a41ab84df33309db3b54f2b9f75bb31644c30b3

    • Size

      312KB

    • MD5

      6f123e6d33cc280d6138bdf61490bd9d

    • SHA1

      230459646d4c8985409879520eb88eaf698a5689

    • SHA256

      12baff892dc37e78e427790d4a41ab84df33309db3b54f2b9f75bb31644c30b3

    • SHA512

      cfbe9e7ff481b820f9fcf2694b1f5d2aceab9c6a01072bd13fd2bdf1f471e2b9bd4eaafb2566b0d795ce62ed1e7245e045640a7df1435fe1a86bc000ef9c64e7

    • SSDEEP

      6144:0yAaQ1BdglcE19mMOJ64SszizGMWS9QcCeLZrdIC0wPysIeN20fu59Bdvka:0yAR1Boc2mMOJYszizPxVCIPpysIG20C

    Score
    10/10
    cobaltstrikebackdoorbootkitpersistencetrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Deletes itself

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks