Overview

overview

10

Static

static

3

a0bde01e83...12.exe

windows7-x64

10

a0bde01e83...12.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a0bde01e83ccc42c0729b813108dd3da96a9bc175b3ad53807387bbf84d58112

  • Size

    350KB

  • Sample

    240410-p9b1gsbg2w

  • MD5

    e48c30853028399ca47333a7009aac65

  • SHA1

    d4296d2e6781ccab7c7fb45a493ba6783aa36b11

  • SHA256

    a0bde01e83ccc42c0729b813108dd3da96a9bc175b3ad53807387bbf84d58112

  • SHA512

    2de96b82471af03ba702cd6379e1d6860310dba1127113c724ac223fe4fe70c5c5ef8060d3033f11a3a4602d4c04447042ec1a5ff4cbb48e6afeb206c29c6243

  • SSDEEP

    6144:anfKej8XSSXcJNB60HNbCf1GPxHqwywYIx83IuoI8YsmPa8iqPjQ8RFWbQ:aJ2iT60tbM+Hp8IxKIuIYxpQ8HWbQ

Score
10/10
cobaltstrike426352781backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

426352781

C2

http://docs.python.org:443/latest/pip-check

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    docs.python.org,/latest/pip-check

  • http_header1

    AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAfUmVmZXJlcjogaHR0cDovL3d3dy5weXRob24ub3JnLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAANAAAAAgAAAAdfX3V0bXo9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAfUmVmZXJlcjogaHR0cDovL3d3dy5weXRob24ub3JnLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAAPAAAADQAAAAUAAAAGX191dG16AAAABwAAAAEAAAAPAAAADQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    2560

  • polling_time

    1000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\dllhost.exe

  • sc_process64

    %windir%\sysnative\dllhost.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDT5/xLtdf0mfbAZ1SOgtXZAyKkM34KWqpUdp4aKli2SeQo2+hL+WTcphBl+t+zIIuiCChggLxQUGMFy0jqJDrYpjcGguHFB4A8I1/otg9K+fNOJ53iEO6Gs89KUZ4kfLYwCcyhaKML+kuLs6nxrEDmKrmAsrtP3L8vpAtWqqthFQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    1.733629184e+09

  • unknown2

    AAAABAAAAAEAAAACAAAAAgAAAAoAAAACAAAAAAAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /latest/check

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36

  • watermark

    426352781

Targets

    • Target

      a0bde01e83ccc42c0729b813108dd3da96a9bc175b3ad53807387bbf84d58112

    • Size

      350KB

    • MD5

      e48c30853028399ca47333a7009aac65

    • SHA1

      d4296d2e6781ccab7c7fb45a493ba6783aa36b11

    • SHA256

      a0bde01e83ccc42c0729b813108dd3da96a9bc175b3ad53807387bbf84d58112

    • SHA512

      2de96b82471af03ba702cd6379e1d6860310dba1127113c724ac223fe4fe70c5c5ef8060d3033f11a3a4602d4c04447042ec1a5ff4cbb48e6afeb206c29c6243

    • SSDEEP

      6144:anfKej8XSSXcJNB60HNbCf1GPxHqwywYIx83IuoI8YsmPa8iqPjQ8RFWbQ:aJ2iT60tbM+Hp8IxKIuIYxpQ8HWbQ

    Score
    10/10
    cobaltstrike426352781backdoortrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks