Overview

overview

10

Static

static

3

10e68f3e6c...07.exe

windows7-x64

1

10e68f3e6c...07.exe

windows10-2004-x64

10

Resubmissions

11/01/2024, 14:51

240111-r8jp2safg810

18/12/2023, 13:56

231218-q8n44acdg810

Sharing

Copy URL Twitter E-mail

General

  • Target
    10e68f3e6c73161a1bba85ef9bada0cd79e25382ea8f8635bec4aa51bfe6c707
  • Size 13KB
  • Sample231218-q8n44acdg8
  • SHA256 10e68f3e6c73161a1bba85ef9bada0cd79e25382ea8f8635bec4aa51bfe6c707
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
cobaltstrike1234567890backdoortrojan

Malware Config

Extracted

Family

  • cobaltstrike

C2

  • http://mail.googlesmail.xyz:2096/home/indexs

Attributes
  • user_agent

    Host: mail.googlesmail.xyz Accept: */* Accept-Encoding: gzip, deflate Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36

Extracted

Family

  • cobaltstrike

Botnet

  • 1234567890

C2

  • http://mail.googlesmail.xyz:2096/api/upload/image

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    mail.googlesmail.xyz,/api/upload/image

  • http_header1

    AAAAEAAAABpIb3N0OiBtYWlsLmdvb2dsZXNtYWlsLnh5egAAAAoAAAALQWNjZXB0OiAqLyoAAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAoAAAAXQ29udGVudC1UeXBlOiB0ZXh0L2h0bWwAAAAHAAAAAAAAAA0AAAACAAAAMFNFU1NJT05JRD1BRUpVTDI0TTIzNEwxM0kwQzgxNEtaS0xJT1pMTEFXRTtkYXRhPQAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAAEAAAABpIb3N0OiBtYWlsLmdvb2dsZXNtYWlsLnh5egAAAAoAAAALQWNjZXB0OiAqLyoAAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAoAAAAXQ29udGVudC1UeXBlOiB0ZXh0L2h0bWwAAAAHAAAAAAAAAA8AAAANAAAABQAAAAN1aWQAAAAHAAAAAQAAAA8AAAANAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • polling_time

    20000

  • port_number

    2096

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCkC2SRh1hyO73pp9PRYlqeqiwBZm/HxDLtVuEJxAf7dzukLxiq++odfLLQ6MB+4hVknTJAHM9+FWz/O8NN5hSRdjYlyHq3s9fVgMMrh2Rt/JhhJApFsU8tKIJVPUbvs9K6PnBozyo60spLEYz5CIMJqOJrEODvzpmuUCdr1u95CQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    1.599476992e+09

  • unknown2

    AAAABAAAAAEAAABfAAAAAgAAAKgAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /web/upload/image

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36

  • watermark

    1234567890

Targets

    • Target
      10e68f3e6c73161a1bba85ef9bada0cd79e25382ea8f8635bec4aa51bfe6c707
    • Size 13KB
    • SHA256 10e68f3e6c73161a1bba85ef9bada0cd79e25382ea8f8635bec4aa51bfe6c707
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    cobaltstrike1234567890backdoortrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks