Overview

overview

10

Static

static

3

fd3f48be97...8b.exe

windows7-x64

10

fd3f48be97...8b.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    fd3f48be97abe0e504038fd143d248991bb8c3559b74aaf7ca7eb5ec465c628b

  • Size

    1.7MB

  • Sample

    240528-myyn1ahc37

  • MD5

    57db7f1815015a7f7a266f3fde48f395

  • SHA1

    4d563b7afef70df4a8a65e68e830494ffd51f149

  • SHA256

    fd3f48be97abe0e504038fd143d248991bb8c3559b74aaf7ca7eb5ec465c628b

  • SHA512

    81b7faf51ceca0a577f43fe51791e1f12c49bf5c8a8e073344429ea9df1d013aab32b9d73070ab866a359420878757169aa523f35902c265fed76dc5ae95c8b5

  • SSDEEP

    49152:FfkflZUokpXob39cid+mSuHf81ocITFeNr:Ff0l3AXq33d+vuHf81BN

Score
10/10
cobaltstrikebackdoortrojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://121.196.245.40:80/D5nv

Attributes
  • user_agent

    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

Targets

    • Target

      fd3f48be97abe0e504038fd143d248991bb8c3559b74aaf7ca7eb5ec465c628b

    • Size

      1.7MB

    • MD5

      57db7f1815015a7f7a266f3fde48f395

    • SHA1

      4d563b7afef70df4a8a65e68e830494ffd51f149

    • SHA256

      fd3f48be97abe0e504038fd143d248991bb8c3559b74aaf7ca7eb5ec465c628b

    • SHA512

      81b7faf51ceca0a577f43fe51791e1f12c49bf5c8a8e073344429ea9df1d013aab32b9d73070ab866a359420878757169aa523f35902c265fed76dc5ae95c8b5

    • SSDEEP

      49152:FfkflZUokpXob39cid+mSuHf81ocITFeNr:Ff0l3AXq33d+vuHf81BN

    Score
    10/10
    cobaltstrikebackdoortrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks