Overview

overview

10

Static

static

3

...mm.dll

windows7-x64

1

...mm.dll

windows10-2004-x64

1

...ps.scr

windows7-x64

10

...ps.scr

windows10-2004-x64

10

....docx

windows7-x64

4

....docx

windows10-2004-x64

1

....lnk

windows7-x64

1

....lnk

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    794c7af6a850461230d5df6e2de755c9ce8489b9d46a4723eb313a56e2aadebd

  • Size

    735KB

  • Sample

    231225-tgtr2sdhd7

  • MD5

    013a376bdb7d69af643169331ed12506

  • SHA1

    acb53a6bf5e2542382230b7e90471ee95e91a194

  • SHA256

    794c7af6a850461230d5df6e2de755c9ce8489b9d46a4723eb313a56e2aadebd

  • SHA512

    46ebe9608b251cf11bae63b47f7bdf7d2346d8d3d50aed7559435c5a5b6e9cbcaac548cb9d68ef9015b1e28e43a189be202d9465c7997a7bb25245f9e5905124

  • SSDEEP

    12288:H5Gok9IttZBlP1fs4escXHZD+5UnIGQ/pyYSTWnRcpR6q/qkN8xbV8bNVV93T:oo+CBLETscJfQjST9R1NMiDbj

Score
10/10
cobaltstrike100000backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000

C2

http://222.186.131.95:39443/api/auth/v1/log

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    222.186.131.95,/api/auth/v1/log

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAcAAAAAAAAAAwAAAAIAAAAKU0VTU0lPTklEPQAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAARQ29ubmVjdGlvbjogY2xvc2UAAAAKAAAAJUFjY2VwdC1MYW5ndWFnZTogZW4tR0I7cT0wLjksICo7cT0wLjcAAAAKAAAAGENvbnRlbnQtVHlwZTogdGV4dC9wbGFpbgAAAAcAAAAAAAAAAwAAAAIAAAAJSlNFU1NJT049AAAABgAAAAZDb29raWUAAAAHAAAAAQAAAAMAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    9984

  • polling_time

    18016

  • port_number

    39443

  • sc_process32

    %windir%\syswow64\runonce.exe

  • sc_process64

    %windir%\sysnative\runonce.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCk8TDQPDxrtDGQd+EZF7en9yNcmEcpX9f9OG5xoAdUEd50W7ip+X1tDdewzxxRp3HdfrK0OxB9cI7NBCKXHDdV+bT6cvTx7EJ0LylxrbclEAMSV6IiSGP9x8bq5ydLNO+IuyT/APMdnUhZYRB9OQ7iwt09O+atIh1E+R/cPkSwTwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    1.481970944e+09

  • unknown2

    AAAABAAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /api/baidu/auth

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36

  • watermark

    100000

Targets

    • Target

      ƽ&ַʥ100Ԫĵ/˵/.res/ProcComm.dll

    • Size

      1.1MB

    • MD5

      b2a1a796fb8a33b051ae560d30b74e8e

    • SHA1

      b06f169055605ff9faec3545e36eeccfa22da42a

    • SHA256

      05176ca81fdcc507b4fb1de01f56234a5370a730e2c2187bf3e6da3df9a9ac29

    • SHA512

      b77ed9cc349e6e417ba6c55828f9a595972d5f9014a0d349e4e3e43453b378f5c239eeb3b4e8ebf0090c2b79f5632a604280c41d707a773a4fb9e3f17cff5269

    • SSDEEP

      24576:cMaCIDDHcXbZ+chP+Rur0Driyhpuec/iSXhAfqowx:daCGHYd2Duy1

    Score
    1/10
    behavioral1behavioral2

    • Target

      ƽ&ַʥ100Ԫĵ/˵/.res/wps.scr

    • Size

      779KB

    • MD5

      d8fc52d9042e6bf1cbd7611976c0a534

    • SHA1

      14243ddd2b76aa05e800304f2d3b65d9fcbb382e

    • SHA256

      9bdac7b0a22a59a5fbab3460c2b05503e248b4a3517b542724d672906861c410

    • SHA512

      e15e2944261020fdb47298eb945c1eb935ec116eac67d2326bdf0f2a8ad99a5c681ad050e6a960503789b8272bab8426f2c800a9b95a352a2924c9afd8cd9e3c

    • SSDEEP

      12288:A5y7EG88YqzELNGqN27LcsHdYkM2ypXUh97rVDoNpCQW37dwS7ndg:gyIoYq17LcYdYkSK97rp2p3W3Ha

    Score
    10/10
    cobaltstrike100000backdoortrojan
    behavioral3behavioral4

    • Target

      ƽ&ַʥ100Ԫĵ/˵/ƽ&ַʥ100Ԫĵ.docx

    • Size

      13KB

    • MD5

      16c7a63012aa4d77f31fc77bfd734d80

    • SHA1

      4cf5373dea58bcaeb4b502cec3a2e5c76bb4b52f

    • SHA256

      e364e89c4c9f50d4782cba50dd27b724eff554b0c6a670861fda98af2f6833c3

    • SHA512

      ca97265dc843a939676e5282f67a8ded9f2d8dab116767fd0c88777a69e7a2297eaae83eaec67e12da471769a5df4234ea79a72fdb607b883799307215fe4cdd

    • SSDEEP

      384:acTShuj8v55nl4vvjk1NFcQrlSNgvhtS4Z:lTS8jinl4vYqssNgveI

    Score
    4/10
    behavioral5behavioral6

    • Target

      ƽ&ַʥ100Ԫĵ/ƽ&ַʥ100Ԫĵ.docx.lnk

    • Size

      748B

    • MD5

      b0d9f8723696d2ce17fb4ba525b4888e

    • SHA1

      8b8d5ec3f43a0114c710b81ceb393490a436767b

    • SHA256

      da7fcce66cf6716483888efa1f8f25acf2a65a7ccdb2b1cbb57f8e952b79bf01

    • SHA512

      31a573a37afa693a9f18d43360f3bf6192476f94512dc8ef4d6b69a794f6a07985aa93ffb90f478a9f250f929242add4cbd7879f2d4bc441593aedb52b13c14f

    Score
    1/10
    behavioral7behavioral8

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks