Overview

overview

10

Static

static

1

af72798564...9b.exe

windows7-x64

10

af72798564...9b.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    af72798564ff3ec193064086bd1cf89b.exe

  • Size

    11KB

  • Sample

    230205-bxc55aba7t

  • MD5

    af72798564ff3ec193064086bd1cf89b

  • SHA1

    276d7e7ce7d07b4f7611a7097473f923441657ca

  • SHA256

    26735c534c886b82f7ec4de59c2b2f8150b7eb079c6714ad71299aaf176c8147

  • SHA512

    3cdf7dfbd0de35345e7446811bb21e8e5c567f9bdef0a6aa0a9da261b6358b0cebdc829afbe03f2a3b72268c094ab2717617572941e7c899b76dc2d943647755

  • SSDEEP

    192:ze+nMDjjjfMgzjOsHPSaGBeQANL6U1HPSh7E5pz6rJoZZYKdlG:cj/MqjBHPHfhL6KHPm7mTj

Score
10/10
cobaltstrikemetasploit1234567890backdoortrojan

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://120.77.18.249:55555/UrHM

Extracted

Family

cobaltstrike

Botnet

1234567890

C2

http://120.77.18.249:55555/ptj

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    120.77.18.249,/ptj

  • http_header1

    AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • polling_time

    60000

  • port_number

    55555

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDtrPl7iA9ImHJLC3epn4KdatXpUizX5lIvGMBD6Btmx8DzXuNM/xuYaG2h4gdr/t5eFYjY7w5i2NR9klhA1DhMW8TmplhQlyZq0zf64aw6G514LJnsZbPpnMHuAaulwlkOTHGTLBXZnEqGKlYKfTiLo9bs8Ftb0MUTuCXYTOLMNQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit.php

  • user_agent

    Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)

  • watermark

    1234567890

Targets

    • Target

      af72798564ff3ec193064086bd1cf89b.exe

    • Size

      11KB

    • MD5

      af72798564ff3ec193064086bd1cf89b

    • SHA1

      276d7e7ce7d07b4f7611a7097473f923441657ca

    • SHA256

      26735c534c886b82f7ec4de59c2b2f8150b7eb079c6714ad71299aaf176c8147

    • SHA512

      3cdf7dfbd0de35345e7446811bb21e8e5c567f9bdef0a6aa0a9da261b6358b0cebdc829afbe03f2a3b72268c094ab2717617572941e7c899b76dc2d943647755

    • SSDEEP

      192:ze+nMDjjjfMgzjOsHPSaGBeQANL6U1HPSh7E5pz6rJoZZYKdlG:cj/MqjBHPHfhL6KHPm7mTj

    Score
    10/10
    cobaltstrikemetasploit1234567890backdoortrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks