General

  • Target

    87a45ff18445565a7221dce2906fc00bbd22f833ecbb73e8e819f61ec84b50ae

  • Size

    1.8MB

  • Sample

    240110-t1nedabaem

  • MD5

    3f35abd9df99db81e8c16b080aa0c1fe

  • SHA1

    fc7e904fe0d92570f01aa7b3550e6de34d0ddb7c

  • SHA256

    87a45ff18445565a7221dce2906fc00bbd22f833ecbb73e8e819f61ec84b50ae

  • SHA512

    4431a4dcd253d61de276044362939f7d7c29e7568b78661f921b1508481820f27ac0f4bbd1df482747803a277bc872d7a5a08ce474e63310d811e1f153b65181

  • SSDEEP

    24576:s4yjkP/tH466NY0bFhTQpKcf0tMh/CXtixK:0K/h46oY0Za4oh/X

Malware Config

Extracted

Family

cobaltstrike

C2

http://154.204.60.86:8787/DzTK

Attributes
  • user_agent

    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENCA)

Targets

    • Target

      87a45ff18445565a7221dce2906fc00bbd22f833ecbb73e8e819f61ec84b50ae

    • Size

      1.8MB

    • MD5

      3f35abd9df99db81e8c16b080aa0c1fe

    • SHA1

      fc7e904fe0d92570f01aa7b3550e6de34d0ddb7c

    • SHA256

      87a45ff18445565a7221dce2906fc00bbd22f833ecbb73e8e819f61ec84b50ae

    • SHA512

      4431a4dcd253d61de276044362939f7d7c29e7568b78661f921b1508481820f27ac0f4bbd1df482747803a277bc872d7a5a08ce474e63310d811e1f153b65181

    • SSDEEP

      24576:s4yjkP/tH466NY0bFhTQpKcf0tMh/CXtixK:0K/h46oY0Za4oh/X

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks