Overview

overview

10

Static

static

10

payload_1.ps1

windows7-x64

10

payload_1.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    payload_1.ps1

  • Size

    293KB

  • Sample

    230809-y1j46sfc49

  • MD5

    982716bca0de500dcfe3ca170258089a

  • SHA1

    25bc2baeaccd30a1fa247cdadae10ca188966106

  • SHA256

    7e86fc3541ca2a8898c9f8c9c5a2dd5602b6d3b88d7b3857cacfa0503232e4a4

  • SHA512

    3670f78f1c6d2a5873b0546ad9d5b7b1a93c271f64ea8410c4474203b425d90691a1883e687a0e0a1f499fdf49576abd63143850f338e60b228bf383c7becf56

  • SSDEEP

    6144:2LR6mHX+TmLD4eyg16i3RJ3rFI8kHMSTpbJN4aXsxxGu:2Fr4ey7ihFFI3HTr/X4

Score
10/10
cobaltstrike674054486backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

674054486

C2

http://185.11.61.85:80/ga.js

Attributes
  • access_type

    512

  • host

    185.11.61.85,/ga.js

  • http_header1

    AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • polling_time

    60000

  • port_number

    80

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDADXzqpTD7NbPs9fk26v4RDX6afZN1KBHf7T2p2Afi0FlDcCNswUBucwmq6FHbUFC0T0mHLT8cDm4ATTrLyYfAqn2zr6XdbObTxFNi+r7yqTsOZyKbGn1kR8NPAdTc5gUsoWGFPDnZiduWFT4sSgpe+j4RKZnM1iZ2EjEW6zUjaQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit.php

  • user_agent

    Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0)

  • watermark

    674054486

Targets

    • Target

      payload_1.ps1

    • Size

      293KB

    • MD5

      982716bca0de500dcfe3ca170258089a

    • SHA1

      25bc2baeaccd30a1fa247cdadae10ca188966106

    • SHA256

      7e86fc3541ca2a8898c9f8c9c5a2dd5602b6d3b88d7b3857cacfa0503232e4a4

    • SHA512

      3670f78f1c6d2a5873b0546ad9d5b7b1a93c271f64ea8410c4474203b425d90691a1883e687a0e0a1f499fdf49576abd63143850f338e60b228bf383c7becf56

    • SSDEEP

      6144:2LR6mHX+TmLD4eyg16i3RJ3rFI8kHMSTpbJN4aXsxxGu:2Fr4ey7ihFFI3HTr/X4

    Score
    10/10
    cobaltstrike674054486backdoortrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks