Overview

overview

10

Static

static

3

AppVIsvSub...64.dll

windows7-x64

1

AppVIsvSub...64.dll

windows10-2004-x64

1

AppVLP.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    docx.zip

  • Size

    642KB

  • Sample

    240412-f5bpgsff78

  • MD5

    b0e4d1d71757e8750140fb326a8194f0

  • SHA1

    ec2cc5893ce06b0327f8f18034e116d31394e876

  • SHA256

    6f9e797b86e5e762635bee6876dfe78f9b417865c6d400c8171ede5107e6d4cf

  • SHA512

    6da285991834b2ad1a44f06f51ce93f9f1796006755588867eb17b367dac30ef657ee8d608639f622bcd6e7658b7e75aa8694c9812fd4ae80d5b1bd1f4c5d85d

  • SSDEEP

    12288:AXX+Lu+Xc0OnlDlukUnbz/LdHRwOao2a5fQHJtNiHmYeQLVa:AXXDrdlxukUpHmOOHzNiT6

Score
10/10
cobaltstrike100000backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000

C2

http://124.220.27.131:1443/jquery-3.3.1.min.js

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    124.220.27.131,/jquery-3.3.1.min.js

  • http_header1

    AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAgUmVmZXJlcjogaHR0cDovL2NvZGUuanF1ZXJ5LmNvbS8AAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADQAAAAIAAAAJX19jZmR1aWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAgUmVmZXJlcjogaHR0cDovL2NvZGUuanF1ZXJ5LmNvbS8AAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADwAAAA0AAAAFAAAACF9fY2ZkdWlkAAAABwAAAAEAAAAPAAAADQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    9472

  • polling_time

    45000

  • port_number

    1443

  • sc_process32

    %windir%\syswow64\dllhost.exe

  • sc_process64

    %windir%\sysnative\dllhost.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCkIYpEQhYcWv4IFd/CtYxePMOrGRAbBk0brIprsIxq/tHsgVrP8+SMaXaxWXrfvLne5rT//eah9ubL7uPrGQTQM7PkYCZrhCkIv+0HmlHdlep8J1xgpKAxOqx0E0CKllxsjDLfGtGrj8ZLVFgiTDACVK/3ofj+2SGOy6PZaNoXUwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4.234810624e+09

  • unknown2

    AAAABAAAAAEAAAXyAAAAAgAAAFQAAAACAAAPWwAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /jquery-3.3.2.min.js

  • user_agent

    Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

  • watermark

    100000

Targets

    • Target

      AppVIsvSubsystems64.dll

    • Size

      1.1MB

    • MD5

      0c60e150bc32545fd2837cf5280398af

    • SHA1

      9edec80cd4d22727431778795fc94fcdd02af889

    • SHA256

      c5ca89b5bbf4d19079dce1954c245bb5cc2b3bd63f98ddc23f1329365ef4dd06

    • SHA512

      955e5a64e85afe17e0909fe466e11d31b284d27029b5c2a4ae619b3beb7a392ac4040c8fbaf67e840409f9c81a57033a7ce6a257624d9e2bf894cffd380ee5ab

    • SSDEEP

      24576:ik7fYerH7nmpWvZahM6iAmZvJRrTgkn242MWUWU4hh6hRJmc:pfYeXmQvZahIQ69V1NUc

    Score
    1/10
    behavioral1behavioral2

    • Target

      AppVLP.exe

    • Size

      491KB

    • MD5

      425f4dfe0d9df6332f7d12b46e70253e

    • SHA1

      6c6f51a65502575ca0fcd628cfcd6fc305e4f66b

    • SHA256

      b9d464982ca65ebf39ebd0b937df518bdc586dd6566724b962e6ef0d6e340d2e

    • SHA512

      1be196b4d149ad5b440e9506f03ab065317add3195f6af9999fbea6fc82938c8570ced26f59b748bb2bc0e1a0f4e0f2204c49f9ae12eda5d2e29d79ee2d3ca9b

    • SSDEEP

      6144:Bel8fWxABEB0d7WfBKu3nmunYOKGFidAgdvJReeFHQKJ+JOjWGNU6ITLwohEVibk:tfoKu3NnYOKGFAdxRetLGNUbTEosOKn

    Score
    10/10
    cobaltstrike100000backdoortrojan
    behavioral3

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks