Overview

overview

10

Static

static

7

303629.exe

windows7-x64

10

303629.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    303629.exe

  • Size

    91KB

  • Sample

    230701-x7st8ahd67

  • MD5

    e24f70509495c9d8406f3d90f60e7e5a

  • SHA1

    9063e95fd91e0b3c396a3089a489671820986816

  • SHA256

    f9a940083bfaf1d29e4eff15533ccd1d90b7726017d81f03677332e4857af2ee

  • SHA512

    6fc25f00d3144bd1e88f6109dbba021c66723eeedc6ead41fffefe7d0e66baa80be3ae8fa10a49551cca151aa03326c85e99c17f6f83a2382a0b859b859cb1fe

  • SSDEEP

    1536:7jk+ySnmP6DiFflAL/UNJEgZSeA3Uav2yWSrXkQc:kcEflXJVmqSTkQc

Score
10/10
cobaltstrikebackdoortrojanupx

Malware Config

Extracted

Family

cobaltstrike

C2

http://43.138.154.3:6443/QlUK

Attributes
  • user_agent

    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

Targets

    • Target

      303629.exe

    • Size

      91KB

    • MD5

      e24f70509495c9d8406f3d90f60e7e5a

    • SHA1

      9063e95fd91e0b3c396a3089a489671820986816

    • SHA256

      f9a940083bfaf1d29e4eff15533ccd1d90b7726017d81f03677332e4857af2ee

    • SHA512

      6fc25f00d3144bd1e88f6109dbba021c66723eeedc6ead41fffefe7d0e66baa80be3ae8fa10a49551cca151aa03326c85e99c17f6f83a2382a0b859b859cb1fe

    • SSDEEP

      1536:7jk+ySnmP6DiFflAL/UNJEgZSeA3Uav2yWSrXkQc:kcEflXJVmqSTkQc

    Score
    10/10
    cobaltstrikebackdoortrojanupx

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks