Overview

overview

10

Static

static

3

2024-04-10...uk.exe

windows7-x64

10

2024-04-10...uk.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-04-10_65d0b8b35444a92f4e43f108d5946646_cobalt-strike_ryuk

  • Size

    404KB

  • Sample

    240410-bms4labd68

  • MD5

    65d0b8b35444a92f4e43f108d5946646

  • SHA1

    2ede8672f7415269db1d2ce047ebaa9e4bc0b3f5

  • SHA256

    c3fa379439346be901dce4362055d9b96bebbd3ebb0032e701f4dc57ec992a52

  • SHA512

    016f2ef7717c7d45ab9397e0f6d6227d75d986da79d95fa537402eddf52a4184ccf231496d837b08af9483270371ae8a6e9b48e66ece916db360a6eff5c77141

  • SSDEEP

    6144:5/wBUQpZh6eH9W5QO2rdrTBvHJJeWFkT0MxkPkJIpSRpetjhH0jn6Evs6w21NYUI:5P6YeH8DErTtuWKwMyPsHRpetVa9LN

Score
10/10
cobaltstrike0426352781backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

426352781

C2

http://120.24.47.154:8080/news/details

Attributes
  • access_type

    512

  • host

    120.24.47.154,/news/details

  • http_header1

    AAAACgAAACZBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94bWw7Ki8qOwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAAEAAAABZIb3N0OiBkcml2ZS5nb29nbGUuY29tAAAACgAAAEtDb29raWU6IFNJRD1Lc1kwZjNmeEllQkxRUm4yd0hNaGdKdlRrRmJXWklFcU55QUJnWF9udmVCdG05TGVFbXNIbjZJOU9tWXpwdzsAAAAHAAAAAAAAAA0AAAAIAAAADQAAAAUAAAACaWQAAAAJAAAAA3U9MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAACZBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94bWw7Ki8qOwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAAEAAAABZIb3N0OiBkcml2ZS5nb29nbGUuY29tAAAACgAAAEtDb29raWU6IFNJRD1Lc1kwZjNmeEllQkxRUm4yd0hNaGdKdlRrRmJXWklFcU55QUJnWF9udmVCdG05TGVFbXNIbjZJOU9tWXpwdzsAAAAHAAAAAQAAAA0AAAAGAAAADVgtQ2xpZW50LURhdGEAAAAHAAAAAAAAAA0AAAAFAAAAAmlkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    GET

  • polling_time

    5000

  • port_number

    8080

  • sc_process32

    %windir%\syswow64\gpupdate.exe

  • sc_process64

    %windir%\sysnative\gpupdate.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDzESqSDKV1cyVnt70NdVdeDYcFXdZy1+CIbBvbl7whKuDauX8H8mINREJZZYdIvzBPuG17JyWp14ofhEFb6LWu6r8PUpn8kmysMSgDsDxvty4s5qXdS5RSwrC6odUpNMsyTvMBSa2JyQ71VNJb4imtUItraCDpBh98trcWQ3Ip/wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown3

    1.610612736e+09

  • uri

    /service/api/json

  • user_agent

    Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.0)

  • watermark

    426352781

Extracted

Family

cobaltstrike

Botnet

0

Attributes
  • watermark

    0

Targets

    • Target

      2024-04-10_65d0b8b35444a92f4e43f108d5946646_cobalt-strike_ryuk

    • Size

      404KB

    • MD5

      65d0b8b35444a92f4e43f108d5946646

    • SHA1

      2ede8672f7415269db1d2ce047ebaa9e4bc0b3f5

    • SHA256

      c3fa379439346be901dce4362055d9b96bebbd3ebb0032e701f4dc57ec992a52

    • SHA512

      016f2ef7717c7d45ab9397e0f6d6227d75d986da79d95fa537402eddf52a4184ccf231496d837b08af9483270371ae8a6e9b48e66ece916db360a6eff5c77141

    • SSDEEP

      6144:5/wBUQpZh6eH9W5QO2rdrTBvHJJeWFkT0MxkPkJIpSRpetjhH0jn6Evs6w21NYUI:5P6YeH8DErTtuWKwMyPsHRpetVa9LN

    Score
    10/10
    cobaltstrike0426352781backdoortrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks