Overview

overview

10

Static

static

3

NEAS.0bc20...JC.exe

windows7-x64

10

NEAS.0bc20...JC.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.0bc20c94b652a770124ec84d040782d0_JC.exe

  • Size

    281KB

  • Sample

    231011-vmf9ksba91

  • MD5

    0bc20c94b652a770124ec84d040782d0

  • SHA1

    295aff07867a857a0355ffe7a5d5879c7db6d584

  • SHA256

    265f487f5e29c6c272b12294ad9a509cf2154f6cf6fe89793e0dd73a95ca33a6

  • SHA512

    58401aefbd0bcc354dec857895aa4f357833bc76fb1e93ab289fb3ea85d7d4e1c2f5baef35f41588ab04a2cd677a06b0fc9f43b54c93a876972a3052c9172cdc

  • SSDEEP

    6144:FCwxtXDFYk/fF0nvQXhsexsWD8yHAo5rATAzkb825KzLUU+:/XDFYYFCUhDxN8Po5rATeR25SU

Score
10/10
cobaltstrike0100000backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000

C2

http://dns.dddumpling.xyz:53/cx

Attributes
  • access_type

    512

  • beacon_type

    256

  • host

    dns.dddumpling.xyz,/cx

  • http_method1

    GET

  • http_method2

    POST

  • maxdns

    255

  • polling_time

    60000

  • port_number

    53

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCh70BlD6Tt5SLsqlLB4SOVblXCOkmUHz7sjazg9EdPKaGvKw8SbffZfGijQRMpErRkqVca3JaaBDzDDwIQL6irMaFjjgClTWOASuAbaDR8p2pI1ck29uVrX0qDQa2uEaAhWX1zsUODyekxkm/C4BEw5wcbk+Y1hWJ5FVCoxC4p4QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • watermark

    100000

Extracted

Family

cobaltstrike

Botnet

0

Attributes
  • watermark

    0

Targets

    • Target

      NEAS.0bc20c94b652a770124ec84d040782d0_JC.exe

    • Size

      281KB

    • MD5

      0bc20c94b652a770124ec84d040782d0

    • SHA1

      295aff07867a857a0355ffe7a5d5879c7db6d584

    • SHA256

      265f487f5e29c6c272b12294ad9a509cf2154f6cf6fe89793e0dd73a95ca33a6

    • SHA512

      58401aefbd0bcc354dec857895aa4f357833bc76fb1e93ab289fb3ea85d7d4e1c2f5baef35f41588ab04a2cd677a06b0fc9f43b54c93a876972a3052c9172cdc

    • SSDEEP

      6144:FCwxtXDFYk/fF0nvQXhsexsWD8yHAo5rATAzkb825KzLUU+:/XDFYYFCUhDxN8Po5rATeR25SU

    Score
    10/10
    cobaltstrike0100000backdoortrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks