Overview

overview

10

Static

static

3

d0d155780e...7a.exe

windows7-x64

10

d0d155780e...7a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d0d155780e84ffe622cc5697e823674ba927454cbced094df9844fa39590847a

  • Size

    1.2MB

  • Sample

    240909-pq62hsxgmq

  • MD5

    92572f3e15a870d155ad97d20f8bfeb9

  • SHA1

    286432a0bfdbc70d358c4ca65cfc93c72dae7b68

  • SHA256

    d0d155780e84ffe622cc5697e823674ba927454cbced094df9844fa39590847a

  • SHA512

    80bbfffbca240607ece9d2c98392fda3570a24df3752d00c01da7bb727e983d85bd3c5ea5b3f43ede9cda9cba4b354dc3f8998dc123248b307f2cac2797cb3e9

  • SSDEEP

    24576:EwanNFm6m+LjlWUvyUF5fYLPtYN56cMBYPWnj18qEvlmXvFxJEue:vanvm6mMqUF5IPq/6cMBYOnj13EvUXdk

Score
10/10
cobaltstrikebackdoortrojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://107.173.165.184:9892/jquery-3.3.2.slim.min.js

Attributes
  • user_agent

    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

Targets

    • Target

      d0d155780e84ffe622cc5697e823674ba927454cbced094df9844fa39590847a

    • Size

      1.2MB

    • MD5

      92572f3e15a870d155ad97d20f8bfeb9

    • SHA1

      286432a0bfdbc70d358c4ca65cfc93c72dae7b68

    • SHA256

      d0d155780e84ffe622cc5697e823674ba927454cbced094df9844fa39590847a

    • SHA512

      80bbfffbca240607ece9d2c98392fda3570a24df3752d00c01da7bb727e983d85bd3c5ea5b3f43ede9cda9cba4b354dc3f8998dc123248b307f2cac2797cb3e9

    • SSDEEP

      24576:EwanNFm6m+LjlWUvyUF5fYLPtYN56cMBYPWnj18qEvlmXvFxJEue:vanvm6mMqUF5IPq/6cMBYOnj13EvUXdk

    Score
    10/10
    cobaltstrikebackdoortrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks