Overview

overview

10

Static

static

3

7d9620b0e4...bb.exe

windows7-x64

10

7d9620b0e4...bb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7d9620b0e406b0aeefe45a987216ac455382d7be45722ea001cbcd773b7904bb

  • Size

    653KB

  • Sample

    230922-hkgfcaeb8z

  • MD5

    5fa0dc5885138db2cd215f4541c38798

  • SHA1

    f16915ab0cd16e3241d1716724c4deaf32db3b8a

  • SHA256

    7d9620b0e406b0aeefe45a987216ac455382d7be45722ea001cbcd773b7904bb

  • SHA512

    4bd79a6835ef6bcfb8bcd18d66e0cc08a4b5089cfdffdba5430cd949c0e824f6e906b241994c41f1e2fd3d9f589fa145258ce3d0067205cf3cd2eaa32e51f55a

  • SSDEEP

    12288:JP3hrZ98Cb2Ff0wLXidDNhtnBJzIxaRK3OdhaivMAd:JP3hD8Cb2Ff0OkDRBJzuCK+3ZMAd

Score
10/10
cobaltstrike0100000backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000

C2

http://106.14.201.1:443/push

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    106.14.201.1,/push

  • http_header1

    AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • polling_time

    60000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCpR/sl9WIVi5K4RIEeSURjnR0Z7VU7NP/Hd3hZ+u8EjNhERGIpQeEELHtE0oE28DuiurLrVNfl07MeAl5fUaJcsVi3OsyfYXmNi9zJQqBHhe+SFOmDxuDyz9czpTpxRgB+Ej+ETYWV6wTr39ji5VaZ/HgJYMsGxpXX/SGKTub2OwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit.php

  • user_agent

    Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; QQDownload 733; InfoPath.2)

  • watermark

    100000

Extracted

Family

cobaltstrike

Botnet

0

Attributes
  • watermark

    0

Targets

    • Target

      7d9620b0e406b0aeefe45a987216ac455382d7be45722ea001cbcd773b7904bb

    • Size

      653KB

    • MD5

      5fa0dc5885138db2cd215f4541c38798

    • SHA1

      f16915ab0cd16e3241d1716724c4deaf32db3b8a

    • SHA256

      7d9620b0e406b0aeefe45a987216ac455382d7be45722ea001cbcd773b7904bb

    • SHA512

      4bd79a6835ef6bcfb8bcd18d66e0cc08a4b5089cfdffdba5430cd949c0e824f6e906b241994c41f1e2fd3d9f589fa145258ce3d0067205cf3cd2eaa32e51f55a

    • SSDEEP

      12288:JP3hrZ98Cb2Ff0wLXidDNhtnBJzIxaRK3OdhaivMAd:JP3hD8Cb2Ff0OkDRBJzuCK+3ZMAd

    Score
    10/10
    cobaltstrike0100000backdoortrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks