Overview

overview

10

Static

static

3

95aaade345...73.exe

windows7-x64

10

95aaade345...73.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    95aaade34593c916bc5bd69742e3d5175da0ce2c1f5e40fb3369e94fa8320f73
  • Size 1.4MB
  • Sample240530-rt7tbsbf4x
  • SHA256 95aaade34593c916bc5bd69742e3d5175da0ce2c1f5e40fb3369e94fa8320f73
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
cobaltstrikebackdoorpersistencetrojan

Malware Config

Extracted

Family

  • cobaltstrike

C2

  • http://8.130.123.131:11001/_/rp/FTmJMkisSOAwXdvbYo-M3c6924I.br.js

Attributes
  • user_agent

    Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 4.0; Trident/4.0)

Targets

    • Target
      95aaade34593c916bc5bd69742e3d5175da0ce2c1f5e40fb3369e94fa8320f73
    • Size 1.4MB
    • SHA256 95aaade34593c916bc5bd69742e3d5175da0ce2c1f5e40fb3369e94fa8320f73
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    cobaltstrikebackdoortrojanpersistence

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Modifies Installed Components in the registry

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks