Overview

overview

10

Static

static

3

f4b3e3fb57...18.exe

windows7-x64

10

f4b3e3fb57...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f4b3e3fb5742db6ebb72c13b5b9543d6_JaffaCakes118

  • Size

    172KB

  • Sample

    240417-a9172sha85

  • MD5

    f4b3e3fb5742db6ebb72c13b5b9543d6

  • SHA1

    ddf139dc51b7aad80b395cde051e05f4b9a94b5a

  • SHA256

    4fa782f0636f06e4991f8148838713d2a7872a342104c2f08a01a0c20159a5ea

  • SHA512

    617a239b51478ed21b94429878b722854d1105b2dda020b08262a321e219fd92327b588a849d9189b70facef978d0f9c09a041d049ab54b5bf55119324566f8f

  • SSDEEP

    3072:vAMycf2WApd8QaNela4BI88D6VfgpSl9wISOICWhl18h65RL7m6EZ/kdKh5ei3zS:HQaNjj88DO9w/KW/18hIm6EhoKX5zte

Score
10/10
cobaltstrike972041620backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

972041620

C2

http://52.15.212.124:443/telemetry_2

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    52.15.212.124,/telemetry_2

  • http_header1

    AAAACgAAADFBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsKi8qLHE9MC44AAAACgAAABlBY2NlcHQtTGFuZ3VhZ2U6IGVuLVVTLGVuAAAACgAAABZDb25uZWN0aW9uOiBrZWVwLWFsaXZlAAAABwAAAAAAAAAPAAAADQAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAABdDYWNoZS1jb250cm9sOiBuby1jYWNoZQAAAAoAAAAWQ29udGVudC1FbmNvZGluZzogZ3ppcAAAAAoAAAARQ29ubmVjdGlvbjogY2xvc2UAAAAHAAAAAQAAAAQAAAAHAAAAAAAAAA0AAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    8448

  • polling_time

    300000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\backgroundTaskHost.exe

  • sc_process64

    %windir%\sysnative\mobsync.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCXy7bqekll06mHUWMDlxK9wwJZzgn71reF9u1pCbTVBkBDJPWLpN8yrjpaxz9tsvKdAwjuiIi8OpKuFrHOfJey6nFg+KbGTmpO0JoW//BQlPWpfYYmJfnS+kvpZMEg+tKDndK1Klq16qAF/f0eCLlFqxketa5EvbyrIfOnvr5IrQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    1.700074752e+09

  • unknown2

    AAAABAAAAAIAAAAJAAAAAwAAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit/telemetry/

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; WOW64; rv:63.0) Gecko/20100101 Firefox/63.0

  • watermark

    972041620

Targets

    • Target

      f4b3e3fb5742db6ebb72c13b5b9543d6_JaffaCakes118

    • Size

      172KB

    • MD5

      f4b3e3fb5742db6ebb72c13b5b9543d6

    • SHA1

      ddf139dc51b7aad80b395cde051e05f4b9a94b5a

    • SHA256

      4fa782f0636f06e4991f8148838713d2a7872a342104c2f08a01a0c20159a5ea

    • SHA512

      617a239b51478ed21b94429878b722854d1105b2dda020b08262a321e219fd92327b588a849d9189b70facef978d0f9c09a041d049ab54b5bf55119324566f8f

    • SSDEEP

      3072:vAMycf2WApd8QaNela4BI88D6VfgpSl9wISOICWhl18h65RL7m6EZ/kdKh5ei3zS:HQaNjj88DO9w/KW/18hIm6EhoKX5zte

    Score
    10/10
    cobaltstrike972041620backdoortrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks