Overview

overview

10

Static

static

3

C618.tmp.dll

windows7-x64

1

C618.tmp.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    C618.tmp.dll

  • Size

    292KB

  • Sample

    240329-nvcg2afh6w

  • MD5

    9abf8579ed3b6e5d3d43b408509a53db

  • SHA1

    63ee039a478e23a505bc889cc74e7693ebe51891

  • SHA256

    cc74f7e82eb33a14ffdea343a8975d8a81be151ffcb753cb3f3be10242c8a252

  • SHA512

    878add89cc7fc1d88f66c0704a66c202191382e4206e6e156f5bf0205d9b136d341c38686dc7d4a36615cfc45937841b30bcbc1b1036084bcce2e8501c6903ce

  • SSDEEP

    6144:lV9H07z+CLXF0AYlHsGSD5E4Ck2oh66/px:lzHqtLyAtG0Ck2ozv

Score
10/10
cobaltstrikebackdoortrojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://217.12.218.46:80/YPbR

Attributes
  • user_agent

    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko

Targets

    • Target

      C618.tmp.dll

    • Size

      292KB

    • MD5

      9abf8579ed3b6e5d3d43b408509a53db

    • SHA1

      63ee039a478e23a505bc889cc74e7693ebe51891

    • SHA256

      cc74f7e82eb33a14ffdea343a8975d8a81be151ffcb753cb3f3be10242c8a252

    • SHA512

      878add89cc7fc1d88f66c0704a66c202191382e4206e6e156f5bf0205d9b136d341c38686dc7d4a36615cfc45937841b30bcbc1b1036084bcce2e8501c6903ce

    • SSDEEP

      6144:lV9H07z+CLXF0AYlHsGSD5E4Ck2oh66/px:lzHqtLyAtG0Ck2ozv

    Score
    10/10
    cobaltstrikebackdoortrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks