Overview

overview

10

Static

static

10

7e86fc3541...a4.ps1

windows7-x64

10

7e86fc3541...a4.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    982716bca0de500dcfe3ca170258089a.bin

  • Size

    148KB

  • Sample

    230811-b77gqabh2t

  • MD5

    9dc7171e9d05b676745dd965c6f236e3

  • SHA1

    8cd62e9959b9fcafc9263f719e4c7e4893289967

  • SHA256

    660702802f58a11f5903666b39dea6361e8b9096ff6f5af2d83355ad1f367c6d

  • SHA512

    6a4858b8842491cc030fc62347deb240f576ea9f9da1d6fb7e91bc09f44116d37e809088a61bfab16ee3147534613d3b4ff8f9823106ec6ccf3e2651fce5c525

  • SSDEEP

    3072:iwugMAf6/7DR9daWw3oqEkZcMU2DMKCgU8SVxnM4:D9xf6/7DrdaX3tBx/Y3TXVxM4

Score
10/10
cobaltstrike674054486backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

674054486

C2

http://185.11.61.85:80/ga.js

Attributes
  • access_type

    512

  • host

    185.11.61.85,/ga.js

  • http_header1

    AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • polling_time

    60000

  • port_number

    80

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDADXzqpTD7NbPs9fk26v4RDX6afZN1KBHf7T2p2Afi0FlDcCNswUBucwmq6FHbUFC0T0mHLT8cDm4ATTrLyYfAqn2zr6XdbObTxFNi+r7yqTsOZyKbGn1kR8NPAdTc5gUsoWGFPDnZiduWFT4sSgpe+j4RKZnM1iZ2EjEW6zUjaQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit.php

  • user_agent

    Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0)

  • watermark

    674054486

Targets

    • Target

      7e86fc3541ca2a8898c9f8c9c5a2dd5602b6d3b88d7b3857cacfa0503232e4a4.ps1

    • Size

      293KB

    • MD5

      982716bca0de500dcfe3ca170258089a

    • SHA1

      25bc2baeaccd30a1fa247cdadae10ca188966106

    • SHA256

      7e86fc3541ca2a8898c9f8c9c5a2dd5602b6d3b88d7b3857cacfa0503232e4a4

    • SHA512

      3670f78f1c6d2a5873b0546ad9d5b7b1a93c271f64ea8410c4474203b425d90691a1883e687a0e0a1f499fdf49576abd63143850f338e60b228bf383c7becf56

    • SSDEEP

      6144:2LR6mHX+TmLD4eyg16i3RJ3rFI8kHMSTpbJN4aXsxxGu:2Fr4ey7ihFFI3HTr/X4

    Score
    10/10
    cobaltstrike674054486backdoortrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks