Overview

overview

10

Static

static

1

vx.exe

windows7-x64

10

vx.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    vx.exe

  • Size

    385KB

  • Sample

    230324-vtwb3sff74

  • MD5

    0483d8bc0a1258011f297d1984f040c7

  • SHA1

    fe2ed57c265d6e99eeba2118e500765354afdcff

  • SHA256

    17ab123e35e0532b63a09c89db6d57ad19b17488f2211f6e6e2fcc3f091b90f2

  • SHA512

    5d7ddc1a9a4a760c3b19387c7a1c8a898093b55ff52b095d1b9c5db0d043375cad79e804b82f1d7375c17190f054f357d4e62224e30b1dc263161b84168a926f

  • SSDEEP

    3072:0orV6p1eJaaPASzaq/13Ja27/7qUF7+3WiXhNivSJFIjHr2oXcWcHDNVRMyObobL:R6WaafB7/OUtiXhNoSJ2GFWeNDw0Ou1

Score
10/10
cobaltstrike666666backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

666666

C2

http://124.223.3.43:8044/_/scs/mail-static/_/js/

Attributes
  • access_type

    512

  • host

    124.223.3.43,/_/scs/mail-static/_/js/

  • http_header1

    AAAABwAAAAAAAAADAAAAAgAAAAVPU0lEPQAAAAYAAAAGQ29va2llAAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAfQWNjZXB0LUxhbmd1YWdlOiBlbi1VUyxlbjtxPTAuNQAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAACgAAAAZETlQ6IDEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACQAAAA11aT1kMzI0NGM0NzA3AAAACQAAAAtob3A9NjkyODYzMgAAAAkAAAAHc3RhcnQ9MAAAAAoAAAA9Q29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQ7Y2hhcnNldD11dGYtOAAAAAcAAAAAAAAAAwAAAAIAAAAFT1NJRD0AAAAGAAAABkNvb2tpZQAAAAcAAAABAAAAAwAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    3840

  • polling_time

    60000

  • port_number

    8044

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCcG2kqoSw8E9T8Cl9ycqidjuKPzv5EblAlDcEXeYDWavhJj4c7w1gqyJNT4v8+gowa/baCxxAWamdmIMA24OZv3FI2ei/sDD9Pklhapa7P3cremdIeGotOLoscwepsVXG+NOEZ0tVsC0hKGMHwk9Qz/2KKMCVG005Im2muwaj5WQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    5.37071616e+08

  • unknown2

    AAAABAAAAAEAAAF3AAAAAQAAAPoAAAACAAAABAAAAAIAAAAcAAAAAgAAACQAAAACAAAAEgAAAAIAAAAEAAAAAgAAABwAAAACAAAAJAAAAAIAAAARAAAAAgAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /mail/u/0/

  • user_agent

    Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.4; .NET4.0C)

  • watermark

    666666

Targets

    • Target

      vx.exe

    • Size

      385KB

    • MD5

      0483d8bc0a1258011f297d1984f040c7

    • SHA1

      fe2ed57c265d6e99eeba2118e500765354afdcff

    • SHA256

      17ab123e35e0532b63a09c89db6d57ad19b17488f2211f6e6e2fcc3f091b90f2

    • SHA512

      5d7ddc1a9a4a760c3b19387c7a1c8a898093b55ff52b095d1b9c5db0d043375cad79e804b82f1d7375c17190f054f357d4e62224e30b1dc263161b84168a926f

    • SSDEEP

      3072:0orV6p1eJaaPASzaq/13Ja27/7qUF7+3WiXhNivSJFIjHr2oXcWcHDNVRMyObobL:R6WaafB7/OUtiXhNoSJ2GFWeNDw0Ou1

    Score
    10/10
    cobaltstrike666666backdoortrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks