Overview

overview

10

Static

static

3

e0de8e1862...a0.exe

windows7-x64

1

e0de8e1862...a0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e0de8e1862d639cefda433a1dd89332378414ed49ba210cbf54f7cacb06292a0

  • Size

    2.1MB

  • Sample

    231123-qcfsvaaa23

  • MD5

    8f40f1cce9dfe3350485509e9eae6a5c

  • SHA1

    f0cdfd64cedf651cdb9f4eb469d528a4e0c3a403

  • SHA256

    e0de8e1862d639cefda433a1dd89332378414ed49ba210cbf54f7cacb06292a0

  • SHA512

    bddbc0df65177bcc25262867b1aa555e1c6c2ec09f791f5a7eddcb17f46a9dfdea6cdc3030dae9565e146839dc4c51e50313d8ce20ce1c9e5966614ca39bb571

  • SSDEEP

    24576:Up1LUk6nBboluqv1iJhk8KkqzOArF2tjuyU6X94nXpb:U/6Bboluqv1iJhY3bphHn

Score
10/10
cobaltstrike0305419896backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://1.92.76.153:80/mAKd

Attributes
  • user_agent

    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; UHS)

Extracted

Family

cobaltstrike

Botnet

305419896

C2

http://1.92.76.153:80/ca

Attributes
  • access_type

    512

  • host

    1.92.76.153,/ca

  • http_header1

    AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • maxdns

    255

  • polling_time

    60000

  • port_number

    80

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCi4QXIbFGqIPWs3gS0lCOzCVFgCwdBUzzU4x+w4kz4a4jEsOZZZmPSQl3P033+dDFGsGOWsrrYKOlGHAPLBStx5bt8sX0q/EWQB4cKXURe49rbXSZ6GXRR55/UFZNHEo6d6E2lS7MpgQQs9jf65pv3H0gEbA9j9J+Vy5r5bXqmEQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit.php

  • user_agent

    Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; MANM)

  • watermark

    305419896

Extracted

Family

cobaltstrike

Botnet

0

Attributes
  • watermark

    0

Targets

    • Target

      e0de8e1862d639cefda433a1dd89332378414ed49ba210cbf54f7cacb06292a0

    • Size

      2.1MB

    • MD5

      8f40f1cce9dfe3350485509e9eae6a5c

    • SHA1

      f0cdfd64cedf651cdb9f4eb469d528a4e0c3a403

    • SHA256

      e0de8e1862d639cefda433a1dd89332378414ed49ba210cbf54f7cacb06292a0

    • SHA512

      bddbc0df65177bcc25262867b1aa555e1c6c2ec09f791f5a7eddcb17f46a9dfdea6cdc3030dae9565e146839dc4c51e50313d8ce20ce1c9e5966614ca39bb571

    • SSDEEP

      24576:Up1LUk6nBboluqv1iJhk8KkqzOArF2tjuyU6X94nXpb:U/6Bboluqv1iJhY3bphHn

    Score
    10/10
    cobaltstrike0305419896backdoortrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks