Overview

overview

10

Static

static

3

Compressed/zzjt.exe

windows7-x64

7

Compressed/zzjt.exe

windows10-2004-x64

10

Compressed...03.exe

windows7-x64

1

Compressed...03.exe

windows10-2004-x64

1

Compressed....exe

windows7-x64

1

Compressed....exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Compressed.rar

  • Size

    14.1MB

  • Sample

    240329-sf7f3sbf23

  • MD5

    2e8dbcd77e72219da1babe000e1d7ae1

  • SHA1

    d64702d81caaa7a1f691ce6be73fdc1368d380a9

  • SHA256

    d0fccd23ea88c3f50248696c43d3a6b4a3ff957094956e24956204e5eb5687cf

  • SHA512

    cd9ce0a878b50a7946092c4f21622c0ddd93c6f3b28c2af5361cf8df45ae41dd97f09b64830a62111e23dc0014d4c6aa07cbfb79927eb9493341c8a6b22c965b

  • SSDEEP

    393216:d7oVzvidF4frf1FxChswmMffs36GsmOtP2l1cJxp7p:dEDoF4fb1yhswpRlmOtP23axp9

Score
10/10
cobaltstrike987654321backdoorpyinstallertrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

987654321

C2

http://74.211.105.140:65443/image/

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    74.211.105.140,/image/

  • http_header1

    AAAACgAAAEhBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKmw7cT0wLjgAAAAKAAAAHlJlZmVyZXI6IGh0dHA6Ly93d3cuZ29vZ2xlLmNvbQAAAAoAAAAQUHJhZ21hOiBuby1jYWNoZQAAAAoAAAAXQ2FjaGUtQ29udHJvbDogbm8tY2FjaGUAAAAHAAAAAAAAAAgAAAABAAAABC5qcGcAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAoAAAAeUmVmZXJlcjogaHR0cDovL3d3dy5nb29nbGUuY29tAAAACgAAABBQcmFnbWE6IG5vLWNhY2hlAAAACgAAABdDYWNoZS1Db250cm9sOiBuby1jYWNoZQAAAAcAAAAAAAAACwAAAAEAAAAELnBuZwAAAAwAAAAHAAAAAQAAAAMAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • polling_time

    60000

  • port_number

    65443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCo6gjeiOv8ikX8LQ2BCTJHeb2MEsiBxqr6QSSAeosvjFwuNgkR5vYGdSCXPqEO2SXE6rhSsJ2RfvmK49TsMoyOXFvLDHIQUzWdc114peOCH6x/5Zc7dGtq6OUeQN2j2PrUY3N/ggHA++sNQLbX/KnOXTzDHUqFh04+Utxb5dAyhwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    1.481970944e+09

  • unknown2

    AAAABAAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /email/

  • user_agent

    Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)

  • watermark

    987654321

Targets

    • Target

      Compressed/zzjt.exe

    • Size

      11.8MB

    • MD5

      7ac31190bf802d29201d85b95a7a979c

    • SHA1

      88c4681ad9268570af2fec3fc50d489500504ffa

    • SHA256

      c020df0b77f8dfa62f37ed491e39a34dba15299f7ad448c69fd3ae9c57dccace

    • SHA512

      00e2156e4ab85617cae29eb22a02724c08b5848797fb0a6bf9be44a3f25eae901a6a6156097a224aa0b44361bbc70b1fce77d409e5f7abfcec331619f1ddba8f

    • SSDEEP

      196608:mW9bTm1k8hkEI/F5D/SFGK1c1W903eV4QRJ993iObM9SEKuLmh6TnW6KJSPG:19bTm28hQfuwW+eGQRT93iOb9cL468Jf

    Score
    10/10
    cobaltstrike987654321backdoortrojan
    behavioral1behavioral2

    • Target

      Compressed/国网福建电力补录申请+王欣+350206199907287303.exe

    • Size

      6.7MB

    • MD5

      6e7ecf0617cd38284cbcee9fc12c5faa

    • SHA1

      453699c96872b7d9dce2a762f13ef7922668234d

    • SHA256

      7b3eb72f56bbbc0b43b7af979b49cfd8b4adc551729f941a8d641cfe3392a84a

    • SHA512

      cfc35a291ddfcc04ec7559a5a0a5ec30d5547736aae229efee573914e5c31b69acae8d6dedde0786e86e64516b9a860198e5682ddbdc9606e2224b8baf795ea3

    • SSDEEP

      49152:9n2ys2OjZMl1n12IBTcXmZ2YFiWEOnTwompQRI3HiyQXOCaj75EmR3KTj66TwBfh:B7Ou1nngmXfEiv3yQOEVPkf

    Score
    1/10
    behavioral3behavioral4

    • Target

      Compressed/宽带未竣工明细ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤ.exe

    • Size

      285KB

    • MD5

      dbdf28a05070848a377065fb7d82c408

    • SHA1

      424b8485ef2a62d2e8f3728d691b32d42fe78006

    • SHA256

      1e252f2be6cf2ba44fecdffd6bf98ed5cb635aee0c6f46da17c2456957107dc2

    • SHA512

      3869fecacadf11e57d8cbaa3ca43821188e1008eea5786ed7458a0cf4298d69abe70e6bb477111339bce52244b9a16796cb3f2657ead44b9ab3b077efc4f10e5

    • SSDEEP

      1536:KYsBzFl3YVwy2wB7wsVMSLDhJh5t5oraIlrxCka52oXKsuWoZcKIBzmA6zO:KYsBzFloVR2wBljsVK2OKsuWoZcKIBQK

    Score
    1/10
    behavioral5behavioral6

MITRE ATT&CK Matrix

Tasks