Overview

overview

10

Static

static

3

afc53035f2...8f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    afc53035f2218c429bc0a7f59a4327f97c178127136f493d4f87c4c8894d9a8f

  • Size

    5.9MB

  • Sample

    240102-azqcssfgc8

  • MD5

    06450e4af2d8757b8e69b42c121d8049

  • SHA1

    d82f7588587df37200a4547e6194f0a83445f4dc

  • SHA256

    afc53035f2218c429bc0a7f59a4327f97c178127136f493d4f87c4c8894d9a8f

  • SHA512

    5570db7ae17e59e7a9bd020c6d3e02b95851ddf2c2a4f308b0236e771f594d49b1100e5e18897ad4e22d41f60ac2b2e6dbc7b7fe683620d05c96f85a72611145

  • SSDEEP

    98304:7uo0mCGGprui39rq8/o2ufPpbeHh8VRu:7uLdGGVuiNWWAbeB8Vo

Score
10/10
cobaltstrike12345backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

12345

C2

http://theerealtruthnews.com:443/knock.json

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    theerealtruthnews.com,/knock.json

  • http_header1

    AAAAEAAAABtIb3N0OiB0aGVlcmVhbHRydXRobmV3cy5jb20AAAAKAAAAEUNvbm5lY3Rpb246IGNsb3NlAAAABwAAAAAAAAAIAAAAAwAAAAIAAAAFQU5JRD0AAAAGAAAABkNvb2tpZQAAAAkAAAAJbWVhbj10cnVlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAAEAAAABtIb3N0OiB0aGVlcmVhbHRydXRobmV3cy5jb20AAAAKAAAAEUNvbm5lY3Rpb246IGNsb3NlAAAACgAAAC9Db250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsZW5jb2RlZAAAAAcAAAABAAAADQAAAAMAAAACAAAABGFnZT0AAAAEAAAABwAAAAAAAAADAAAAAgAAAA5fX3Nlc3Npb25fX2lkPQAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    5888

  • polling_time

    32

  • port_number

    443

  • sc_process32

    %windir%\syswow64\gpupdate.exe

  • sc_process64

    %windir%\sysnative\gpupdate.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCgMczQC3gEJhIUBFsBblz1YSY9vo+MUGeIc9yOJytURUzl0k9FRovU8uru/EqPkgI/3zpUKq6rnGPB90KGGMPKVYofTpq6LLMt6MC99LRRwxo7OV0zPodCSG/vcj/6c3uwIWvcbwTw1hlIBN/q8VvETUm8VfSCeXwrl4zK+z9umQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4.289407488e+09

  • unknown2

    AAAABAAAAAIAAAFTAAAAAwAAAAsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /sail

  • user_agent

    Mozilla/5.0 (Linux; arm_64; Android 11; M2003J15SC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.85 YaBrowser/21.11.0.251.00 SA/3 Mobile Safari/537.36

  • watermark

    12345

Targets

    • Target

      afc53035f2218c429bc0a7f59a4327f97c178127136f493d4f87c4c8894d9a8f

    • Size

      5.9MB

    • MD5

      06450e4af2d8757b8e69b42c121d8049

    • SHA1

      d82f7588587df37200a4547e6194f0a83445f4dc

    • SHA256

      afc53035f2218c429bc0a7f59a4327f97c178127136f493d4f87c4c8894d9a8f

    • SHA512

      5570db7ae17e59e7a9bd020c6d3e02b95851ddf2c2a4f308b0236e771f594d49b1100e5e18897ad4e22d41f60ac2b2e6dbc7b7fe683620d05c96f85a72611145

    • SSDEEP

      98304:7uo0mCGGprui39rq8/o2ufPpbeHh8VRu:7uLdGGVuiNWWAbeB8Vo

    Score
    10/10
    cobaltstrike12345backdoortrojan
    behavioral1

MITRE ATT&CK Matrix

Tasks