Overview

overview

10

Static

static

3

beacon.exe

windows7-x64

10

beacon.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f04b67bd1c713c775d16c34bb310272190bf2baf59179533297222e4b26326fe

  • Size

    161KB

  • Sample

    231225-2mhkzacacp

  • MD5

    7010b4f99d62675e5635067826b87891

  • SHA1

    ad30129a6a3975b2d48af9009de5f2be541c1f12

  • SHA256

    f04b67bd1c713c775d16c34bb310272190bf2baf59179533297222e4b26326fe

  • SHA512

    7c6e8143ab461557b631df13674f3786b212b19be5e3e71bc7d2c687007ad0a50890bc7cb3b9f6d0a20e5ae8eb6895e480d62dfbab72896500f027207fcb09ec

  • SSDEEP

    3072:FSCxkE8RblSZ4ZhMsUsQzpDOb8xLtaqnCas3IFU/EJI29nt9MjzQ3aoFQmkQv:F5aE8RblSZ4Zhs1pDOb8LaqvpaEienYC

Score
10/10
cobaltstrike0305419896backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

305419896

C2

http://94.158.244.219:8080/load

Attributes
  • access_type

    512

  • host

    94.158.244.219,/load

  • http_header1

    AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • maxdns

    255

  • polling_time

    60000

  • port_number

    8080

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCE24y0srt9EenXtc60BwClhEkssIgZA1/kzKufG1Jejg2672muYtGDCrE9lQIEvu/g0uBjCimxwGwqZEhsBH91zp0z4gCoq8SQkOpNvRs+205dq2cv0Bztw7eRypY4EJaAkEygbfrk7H3mu/PgfbOPtEG3Wmoxpflot+7sLUKATQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit.php

  • user_agent

    Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)

  • watermark

    305419896

Extracted

Family

cobaltstrike

Botnet

0

Attributes
  • watermark

    0

Targets

    • Target

      beacon.exe

    • Size

      281KB

    • MD5

      baac42704b6558c28303c5107230be2f

    • SHA1

      47b4fcfd0b7537d41f321ea808031f4fa7cad894

    • SHA256

      133fc31bda2c7dce73c1a8f9313e0e10c7f8c961d460b2bf8b57fd75a5db3265

    • SHA512

      e3f8a36341af5198326fa1cf90208e0d0d22b581915af164208dc8a561bfbaebef81fa69aae38869ad32ed6fa31c4aac1e14248156ba78c2d55e01db3d2d1d98

    • SSDEEP

      6144:iSAoYGHUu+fSuR09csUceD43vcvESysHggIge78Mxe6kpNx:CasSa09VUmcvvyYug2xe6kpNx

    Score
    10/10
    cobaltstrike0305419896backdoortrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks