Overview

overview

10

Static

static

3

5175d99253...22.exe

windows7-x64

10

5175d99253...22.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5175d9925396339ff7bf7b1d838fd8c1ccd178b8492f5ced8c8e72a24ec2a922

  • Size

    2.0MB

  • Sample

    231103-d8n3wabe8s

  • MD5

    1035b6f0183fbfca5110e9c702ab70ed

  • SHA1

    6aeb9e0194dcf0ddd1f141f360c360657f354c02

  • SHA256

    5175d9925396339ff7bf7b1d838fd8c1ccd178b8492f5ced8c8e72a24ec2a922

  • SHA512

    6823c92e4ce32fcd021a69760c86f205b9e2379b9f1033946e7e2b36de7024b8ce243045fdcdef6c424de928dcbafe5060fcbd59192b4ea897221e3dac53dc8a

  • SSDEEP

    24576:VBkFg8XoYy1tQywBFK7VuuFbK/FDN18BImnPS0KJJkA0fWFdkgiZ/ggHKUfq9trr:oFg8XLXMKB0f4gZCrI

Score
10/10
cobaltstrike100000000backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000000

C2

http://service-etdb74nf-1307700818.sh.apigw.tencentcs.com:443/for

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    service-etdb74nf-1307700818.sh.apigw.tencentcs.com,/for

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQWNjZXB0LUxhbmd1YWdlOiBlbi11cwAAAAoAAAAbQWNjZXB0LUVuY29kaW5nOiB0ZXh0L3BsYWluAAAACgAAAC9Db250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsdHJ5dHJ5ZAAAAAcAAAAAAAAAAwAAAAIAAAAiU0VTU0lPTklEPXdxZTQ1NHdxZTJkczE1ZHM0ZHNhNWRzNAAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQWNjZXB0LUxhbmd1YWdlOiBlbi11cwAAAAoAAAAbQWNjZXB0LUVuY29kaW5nOiB0ZXh0L3BsYWluAAAACgAAAC9Db250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsdHJ5dHJ5ZAAAAAcAAAAAAAAAAwAAAAIAAAAjSlNFU1NJT049ZHNmNXNkNGY1ZTQ1ZmU0czY1ZDRmODU2ZTQAAAAGAAAABkNvb2tpZQAAAAcAAAABAAAAAwAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    10240

  • polling_time

    8000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCWYBRCUGvl4lXrbWXhkeLf6EP41z+Q+3ga/YbLo8ce43czRLAnA5pTxbMQJn79lCuz1g3OuyOGrukoqj+pxI6gZMNfLlI57ElYVUQQ+KoHuGuzI2rVFUkgpwHtwmQxY3viCi1SDCBe89QfiM2PU8d7aeK1loQCK4krNiaqPCXhGQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    1.481970944e+09

  • unknown2

    AAAABAAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /authorize.php

  • user_agent

    Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0 (ax)

  • watermark

    100000000

Targets

    • Target

      5175d9925396339ff7bf7b1d838fd8c1ccd178b8492f5ced8c8e72a24ec2a922

    • Size

      2.0MB

    • MD5

      1035b6f0183fbfca5110e9c702ab70ed

    • SHA1

      6aeb9e0194dcf0ddd1f141f360c360657f354c02

    • SHA256

      5175d9925396339ff7bf7b1d838fd8c1ccd178b8492f5ced8c8e72a24ec2a922

    • SHA512

      6823c92e4ce32fcd021a69760c86f205b9e2379b9f1033946e7e2b36de7024b8ce243045fdcdef6c424de928dcbafe5060fcbd59192b4ea897221e3dac53dc8a

    • SSDEEP

      24576:VBkFg8XoYy1tQywBFK7VuuFbK/FDN18BImnPS0KJJkA0fWFdkgiZ/ggHKUfq9trr:oFg8XLXMKB0f4gZCrI

    Score
    10/10
    cobaltstrike100000000backdoortrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks