Overview

overview

10

Static

static

1

code.ps1

windows7-x64

1

code.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    code.ps1

  • Size

    766KB

  • Sample

    231124-zfqlwseh7v

  • MD5

    bf15dd6c8983522f2c91d5bdf2b0aa9c

  • SHA1

    2c17cbcea715a1bb9f917dea496f6eab9c9321a4

  • SHA256

    74e771f7a3ea87e284c14253fab8a0b3cad392151d0d700e67435a71beab621d

  • SHA512

    50eb8f957067fe6872e404f913cebae49518a5407c8d41da23315c5dcf3c82d3eacc26978d2d4f2a9b14076f4baa45871656c0d83df55034c8b4513e712243e6

  • SSDEEP

    12288:FOLCn7jd7JeUlxXBJUQuMPCQmzxV38uMY:lVPTBJILR8uMY

Score
10/10
cobaltstrike12345backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

12345

C2

http://theerealtruthnews.com:443/knock.json

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    theerealtruthnews.com,/knock.json

  • http_header1

    AAAAEAAAABtIb3N0OiB0aGVlcmVhbHRydXRobmV3cy5jb20AAAAKAAAAEUNvbm5lY3Rpb246IGNsb3NlAAAABwAAAAAAAAAIAAAAAwAAAAIAAAAFQU5JRD0AAAAGAAAABkNvb2tpZQAAAAkAAAAJbWVhbj10cnVlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAAEAAAABtIb3N0OiB0aGVlcmVhbHRydXRobmV3cy5jb20AAAAKAAAAEUNvbm5lY3Rpb246IGNsb3NlAAAACgAAAC9Db250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsZW5jb2RlZAAAAAcAAAABAAAADQAAAAMAAAACAAAABGFnZT0AAAAEAAAABwAAAAAAAAADAAAAAgAAAA5fX3Nlc3Npb25fX2lkPQAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    5888

  • polling_time

    32

  • port_number

    443

  • sc_process32

    %windir%\syswow64\gpupdate.exe

  • sc_process64

    %windir%\sysnative\gpupdate.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCgMczQC3gEJhIUBFsBblz1YSY9vo+MUGeIc9yOJytURUzl0k9FRovU8uru/EqPkgI/3zpUKq6rnGPB90KGGMPKVYofTpq6LLMt6MC99LRRwxo7OV0zPodCSG/vcj/6c3uwIWvcbwTw1hlIBN/q8VvETUm8VfSCeXwrl4zK+z9umQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4.289407488e+09

  • unknown2

    AAAABAAAAAIAAAFTAAAAAwAAAAsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /sail

  • user_agent

    Mozilla/5.0 (Linux; arm_64; Android 11; M2003J15SC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.85 YaBrowser/21.11.0.251.00 SA/3 Mobile Safari/537.36

  • watermark

    12345

Targets

    • Target

      code.ps1

    • Size

      766KB

    • MD5

      bf15dd6c8983522f2c91d5bdf2b0aa9c

    • SHA1

      2c17cbcea715a1bb9f917dea496f6eab9c9321a4

    • SHA256

      74e771f7a3ea87e284c14253fab8a0b3cad392151d0d700e67435a71beab621d

    • SHA512

      50eb8f957067fe6872e404f913cebae49518a5407c8d41da23315c5dcf3c82d3eacc26978d2d4f2a9b14076f4baa45871656c0d83df55034c8b4513e712243e6

    • SSDEEP

      12288:FOLCn7jd7JeUlxXBJUQuMPCQmzxV38uMY:lVPTBJILR8uMY

    Score
    10/10
    cobaltstrike12345backdoortrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks