Overview

overview

10

Static

static

1

455381bfd3...bf.exe

windows7-x64

10

455381bfd3...bf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    056b795d0b4e4d7a4fb23a2001dabe25.bin

  • Size

    8KB

  • Sample

    230331-bcwrqshd5v

  • MD5

    aa8b7cbb5b31e63da34bfc24799d6770

  • SHA1

    e93b2a947fdcca3992752411c20455ba97d0731d

  • SHA256

    9a88bd7e3e20d7f5ef693f9f838c7277e9121aae3b5277d966cbf162bce345a8

  • SHA512

    afb30da7501b033bf8bfda21d09815f89cb28e71344f4d822d481b6b184a6b38d4fdb7a439a5697c7886c4f3b616f6213aab441b1af1e15ccd80c27f42ae06a6

  • SSDEEP

    192:t2eqtEW6tMOf3b2cNLyWC8PgikneOL6nO17opxcGp+L7sp:YtOGOfb2c9yWCQgiPnFpdp+I

Score
10/10
cobaltstrike01234567890backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://120.25.236.78:44333/Irn4

Attributes
  • user_agent

    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENAU)

Extracted

Family

cobaltstrike

Botnet

1234567890

C2

http://120.25.236.78:44333/cm

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    120.25.236.78,/cm

  • http_header1

    AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • polling_time

    60000

  • port_number

    44333

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDaftVcO9i1pOQnWOTb5pPYWSW5RiPYlaVISunHJdG9B40ERLRCvOpfvdPrgku0aJoIaoPkdnq9bbEhioFIj5PQko/yRDqivcbGOs0KMxDhmxCdkELVoI75g432kJdbMlmfzV8pjCYCFHhiI1/s0cLy0/cxupoZAeTvYBRy57mp8QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit.php

  • user_agent

    Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; QQDownload 733; InfoPath.2)

  • watermark

    1234567890

Extracted

Family

cobaltstrike

Botnet

0

Attributes
  • watermark

    0

Targets

    • Target

      455381bfd322608f89657a5ce2d4875b3c1f7dacfecfea0dca33d7e82aa3c6bf.exe

    • Size

      17KB

    • MD5

      056b795d0b4e4d7a4fb23a2001dabe25

    • SHA1

      3a7a771ea02cb9af9b8152dc8209b9b735056e01

    • SHA256

      455381bfd322608f89657a5ce2d4875b3c1f7dacfecfea0dca33d7e82aa3c6bf

    • SHA512

      df4170dfc909b0b6c26e27961a8bdf8cdec68ec07557d471c6dcd0463e0e3502f6515c612da52a205cb060d11f4d12dcd583d44f9effbc114204b84a2985ce1c

    • SSDEEP

      192:6DMAe4Ckj19RZZ6wpSfu1bKcq5uHj7khBDSeKNH4ZNPwzXlBUbOj6kxiY:6DMAoKz6WtKEj7aBDixzXlbAY

    Score
    10/10
    cobaltstrikebackdoortrojan01234567890
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks