Overview

overview

10

Static

static

10

85918aef36...70.exe

windows7-x64

10

85918aef36...70.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    85918aef3618bcacf1cb82814368ae6718b00520e37c13d415b4275a5cb9e270

  • Size

    307KB

  • Sample

    221201-cawjmaha4w

  • MD5

    ebb5faf5d40d89b8fbee0fb5ee580b93

  • SHA1

    b6d4b6b74adc556bd8853176303c7b3bbeaddc61

  • SHA256

    85918aef3618bcacf1cb82814368ae6718b00520e37c13d415b4275a5cb9e270

  • SHA512

    2a648a6335602271a04ac57215eecffc6a340a654d05364262c16291b7057ba9132c8d4d50770dd6df351c62ed8f58c2c303dd587f0303284aa5311d1456bac5

  • SSDEEP

    6144:K0vzDT72Y0SmzinYKTY1SQshfRPVQe1MZkIYSccr7wbstOQPECYeixlYGich:K0bn7SShYsY1UMqMZJYSN7wbstOQ8fv3

Score
10/10
cobaltstrikebackdoorpersistencetrojan

Malware Config

Targets

    • Target

      85918aef3618bcacf1cb82814368ae6718b00520e37c13d415b4275a5cb9e270

    • Size

      307KB

    • MD5

      ebb5faf5d40d89b8fbee0fb5ee580b93

    • SHA1

      b6d4b6b74adc556bd8853176303c7b3bbeaddc61

    • SHA256

      85918aef3618bcacf1cb82814368ae6718b00520e37c13d415b4275a5cb9e270

    • SHA512

      2a648a6335602271a04ac57215eecffc6a340a654d05364262c16291b7057ba9132c8d4d50770dd6df351c62ed8f58c2c303dd587f0303284aa5311d1456bac5

    • SSDEEP

      6144:K0vzDT72Y0SmzinYKTY1SQshfRPVQe1MZkIYSccr7wbstOQPECYeixlYGich:K0bn7SShYsY1UMqMZJYSN7wbstOQ8fv3

    Score
    10/10
    cobaltstrikebackdoorpersistencetrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks