General

  • Target

    nccu_https.exe

  • Size

    1.3MB

  • Sample

    230324-qt23eagg2z

  • MD5

    85750b5a758a95e1414666a787555225

  • SHA1

    5d49b767031f39dd08bd0837d28881f79420a775

  • SHA256

    1b12a4fbc41eba03bd430a77f2afad8ca06d4676d7970a7e61a868069bb3ae41

  • SHA512

    e2594d13e308bf18f6ec07a7ba058c12eafdc41605e93bc2d90f0b4a4c4db2c29689e2fba9c340e841dd64ec86e40a82e63eefcfbdfbd0ffe1e4e6695a7e598d

  • SSDEEP

    24576:Ds0hsXS5iccj3CR+NZ7frTMNjx5/PX5s0gl+W:DzP5k3DM/h5s0gl+W

Malware Config

Extracted

Family

cobaltstrike

C2

http://198.52.127.146:21988/understand/tips/GMY0TY2G

Attributes
  • user_agent

    Accept: application/xml, image/*, text/html Accept-Language: ca Accept-Encoding: *, br User-Agent: Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36

Targets

    • Target

      nccu_https.exe

    • Size

      1.3MB

    • MD5

      85750b5a758a95e1414666a787555225

    • SHA1

      5d49b767031f39dd08bd0837d28881f79420a775

    • SHA256

      1b12a4fbc41eba03bd430a77f2afad8ca06d4676d7970a7e61a868069bb3ae41

    • SHA512

      e2594d13e308bf18f6ec07a7ba058c12eafdc41605e93bc2d90f0b4a4c4db2c29689e2fba9c340e841dd64ec86e40a82e63eefcfbdfbd0ffe1e4e6695a7e598d

    • SSDEEP

      24576:Ds0hsXS5iccj3CR+NZ7frTMNjx5/PX5s0gl+W:DzP5k3DM/h5s0gl+W

MITRE ATT&CK Matrix

Tasks