Overview

overview

10

Static

static

10

9274d8774c...6e.exe

windows7-x64

10

9274d8774c...6e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9274d8774c967a3d5f40d5546c2915b2f78b3ef7a6e3abcc5d6e6c19e3f39e6e

  • Size

    305KB

  • Sample

    221129-f1q9dacg9w

  • MD5

    6a336eabaaefe7bc8f3d6b5f94f68b6a

  • SHA1

    8e0d2e4040449041820c87519b1b7ffd4fc0d3b1

  • SHA256

    9274d8774c967a3d5f40d5546c2915b2f78b3ef7a6e3abcc5d6e6c19e3f39e6e

  • SHA512

    a19da9f283d9661a55e4a3c5466439a4886fc2aeea6493d7ee53facc043ec3f1c3bf304a7719bfb3a853a4bac9fca9728a07811262d31add77ba80dc422f0cf8

  • SSDEEP

    6144:1GSzQfT72Y0SuzinYKTY1SQshfRPVQe1MZkIYSccr7wbstOYPECYeixlYGicm:1GqQ77SS5YsY1UMqMZJYSN7wbstOY8fY

Score
10/10
cobaltstrikebackdoorpersistencetrojan

Malware Config

Targets

    • Target

      9274d8774c967a3d5f40d5546c2915b2f78b3ef7a6e3abcc5d6e6c19e3f39e6e

    • Size

      305KB

    • MD5

      6a336eabaaefe7bc8f3d6b5f94f68b6a

    • SHA1

      8e0d2e4040449041820c87519b1b7ffd4fc0d3b1

    • SHA256

      9274d8774c967a3d5f40d5546c2915b2f78b3ef7a6e3abcc5d6e6c19e3f39e6e

    • SHA512

      a19da9f283d9661a55e4a3c5466439a4886fc2aeea6493d7ee53facc043ec3f1c3bf304a7719bfb3a853a4bac9fca9728a07811262d31add77ba80dc422f0cf8

    • SSDEEP

      6144:1GSzQfT72Y0SuzinYKTY1SQshfRPVQe1MZkIYSccr7wbstOYPECYeixlYGicm:1GqQ77SS5YsY1UMqMZJYSN7wbstOY8fY

    Score
    10/10
    cobaltstrikebackdoorpersistencetrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks