Overview

overview

10

Static

static

3

96ae4d7d44...ef.exe

windows7-x64

10

96ae4d7d44...ef.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    96ae4d7d4475864ad3727493814e08346f46b13a665655ff631be0fceda29aef

  • Size

    830KB

  • Sample

    240409-vnlkpadb52

  • MD5

    9084ba9e0f2dc1a346638b8b000512fe

  • SHA1

    75ee3a41f7fe4fb8da5f5d7df4a8050609ce0f8a

  • SHA256

    96ae4d7d4475864ad3727493814e08346f46b13a665655ff631be0fceda29aef

  • SHA512

    8520e6eb10a7459ff1fde9baa0e5dcafa3f4839bac3ad1f9865ec562eaa0f853394030ffb097c46a6113a9d593dc7dffa9483651bdbfb711d54b5935bdbf7eee

  • SSDEEP

    12288:WNVVNWURpbVuS3SdgpRRuuWkEbQbltoTAVUZPL5iO:WNVH3X6YRVsbQ5taA

Score
10/10
cobaltstrike391144938backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

391144938

C2

http://www.sevensix.shop:80/c/msdownload/update/others/2023/01/29136388_

Attributes
  • access_type

    512

  • host

    www.sevensix.shop,/c/msdownload/update/others/2023/01/29136388_

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAcAAAAAAAAADQAAAAEAAAAELmNhYgAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAcAAAAAAAAADQAAAAEAAAAELmNhYgAAAAwAAAAHAAAAAQAAAA0AAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    2560

  • polling_time

    60000

  • port_number

    80

  • sc_process32

    %windir%\syswow64\wuauclt.exe

  • sc_process64

    %windir%\sysnative\wuauclt.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCDe85UFUE5oDj/HyI5Nm+G1x9IJcAArW+zyp9sSCy3Lct2RZbB+PrW7oJqE8w51gGU1mzGhw+9w9aTsV/KNzoPj/O0wXPhy/GpNBEZfkjDNGYAZvRf+icWz1+A1fk2EXPQ3lcK0Nx129lKlgQf8ZyQdBzeFdw1k5ZHaWQa0QLC5wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    1.448416512e+09

  • unknown2

    AAAABAAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /c/msdownload/update/others/2023/01/3215234_

  • user_agent

    Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.31

  • watermark

    391144938

Targets

    • Target

      96ae4d7d4475864ad3727493814e08346f46b13a665655ff631be0fceda29aef

    • Size

      830KB

    • MD5

      9084ba9e0f2dc1a346638b8b000512fe

    • SHA1

      75ee3a41f7fe4fb8da5f5d7df4a8050609ce0f8a

    • SHA256

      96ae4d7d4475864ad3727493814e08346f46b13a665655ff631be0fceda29aef

    • SHA512

      8520e6eb10a7459ff1fde9baa0e5dcafa3f4839bac3ad1f9865ec562eaa0f853394030ffb097c46a6113a9d593dc7dffa9483651bdbfb711d54b5935bdbf7eee

    • SSDEEP

      12288:WNVVNWURpbVuS3SdgpRRuuWkEbQbltoTAVUZPL5iO:WNVH3X6YRVsbQ5taA

    Score
    10/10
    cobaltstrike391144938backdoortrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks