Overview

overview

10

Static

static

3

22fb819448...32.exe

windows7-x64

1

22fb819448...32.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    22fb819448d8e85337389b0216a9f8da9a4e7adc939cc386c88793e8ed06f432

  • Size

    2.7MB

  • Sample

    240426-mfmtsaed6w

  • MD5

    fde6f29d0c6830adf1b363806a31f3de

  • SHA1

    7d69d8e3998a5fb81d42156baef3a39c9c9514c8

  • SHA256

    22fb819448d8e85337389b0216a9f8da9a4e7adc939cc386c88793e8ed06f432

  • SHA512

    57987e2748d66594775f075862127971b6bf29ad8502c11af76f2beb9145173449674171c08999285c73de58c8dc0265a9391200e23f319efe86434b0245d609

  • SSDEEP

    24576:gA/6cfDiOoLAERY4IfkYRiP1mxgZJedoYtgE0jZSODBjvFmuSk4w+6U1+37DIuQD:gANDiOoLxY4I7ksWNhfZZWWcYti

Score
10/10
cobaltstrike391144938backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

391144938

C2

http://www.fiash.info:2053/api/3

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    www.fiash.info,/api/3

  • http_header1

    AAAAEAAAABRIb3N0OiB3d3cuZmlhc2guaW5mbwAAAAcAAAAAAAAAAwAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAAEAAAABRIb3N0OiB3d3cuZmlhc2guaW5mbwAAAAcAAAAAAAAADAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • polling_time

    30000

  • port_number

    2053

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC9aTwoVUohtdljeFb9juyDC4Wo44leNzO+gbxmkQTvlXL0zVUiEEMn3BbaFCGGb1SOYg8UWRgXNCrOWvCmL4QTxZ0VX+sfxnAIg+QDxcHltsNir12GWUm4qC3f9x/5JbLCdnRvemRFChOi3HRb5RgnzekXvN8kUU5zBP/FDGzZ7QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /api/4

  • user_agent

    Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

  • watermark

    391144938

Targets

    • Target

      22fb819448d8e85337389b0216a9f8da9a4e7adc939cc386c88793e8ed06f432

    • Size

      2.7MB

    • MD5

      fde6f29d0c6830adf1b363806a31f3de

    • SHA1

      7d69d8e3998a5fb81d42156baef3a39c9c9514c8

    • SHA256

      22fb819448d8e85337389b0216a9f8da9a4e7adc939cc386c88793e8ed06f432

    • SHA512

      57987e2748d66594775f075862127971b6bf29ad8502c11af76f2beb9145173449674171c08999285c73de58c8dc0265a9391200e23f319efe86434b0245d609

    • SSDEEP

      24576:gA/6cfDiOoLAERY4IfkYRiP1mxgZJedoYtgE0jZSODBjvFmuSk4w+6U1+37DIuQD:gANDiOoLxY4I7ksWNhfZZWWcYti

    Score
    10/10
    cobaltstrike391144938backdoortrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks