Overview

overview

10

Static

static

3

rundll.exe

windows7-x64

1

rundll.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7eeaeb11a6091d6ac31ec96ba70e6fbc904da0dc0f8e97ddc5c8f193fc14692e

  • Size

    596KB

  • Sample

    240911-tk5nqazcll

  • MD5

    fe5f522e45e7fcf8cc3ebb666cf29cc4

  • SHA1

    a529ffcbb850792283859baeffc2dcdeb58fb059

  • SHA256

    7eeaeb11a6091d6ac31ec96ba70e6fbc904da0dc0f8e97ddc5c8f193fc14692e

  • SHA512

    d472da6c82b3b506e67cbb845ce43ede659d164bc60931dbeac6204c2b00b0fb0bf21acd45111e8f6f7919e5235cbc2977a26db089d50f54dfb2093fd40177fa

  • SSDEEP

    12288:HpmmRUvk7QrLX9mt7sjWop2ZDpvjqBJBAHRyA5jSiQA7:aTAwjW00pvjGAHRykWs

Score
10/10
cobaltstrikebackdoortrojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://79.110.52.22:443/components/as.png

Attributes
  • user_agent

    Host: tgmcheck.com Connection: close User-Agent: Mozilla/5.0 (Linux; Android 7.0; Pixel C Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0

Targets

    • Target

      rundll.exe

    • Size

      1.6MB

    • MD5

      b6f38a50620db20ac5c231f924f3b4a5

    • SHA1

      635d79bbab78af66e561e2146ed0f5926dc886fb

    • SHA256

      24630db019f0de35f81c0a712d62ed04db084cdd287ea803f588e0f808186f98

    • SHA512

      bf6fa80d2e973faab2bf8cdf35aa7a4975b511fe2175a57b4ba86c670a49fc17a8c2aa6389578df1cf6a065effc0057384873ff6215eca0cb693e77a3f8272ed

    • SSDEEP

      12288:ehJK5SJT91q5uM97uyuYpxwu5T1v+rMORuIDJI4yN/6YYJNtuX3e9ifzRBexvVIx:kJP3qeyff5k+5/EP0+9ue52kaX58oj

    Score
    10/10
    cobaltstrikebackdoortrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks