General

  • Target

    ea38c533662b353a9d473e8f59f39de0c23ff1cf3726f676feca800a0c934308

  • Size

    24KB

  • Sample

    240913-l33m3sxcml

  • MD5

    e21f3ef3f5c69eb62c15ef87528dbb0d

  • SHA1

    5e7be9b8ab4f154afdca2729cbe6eb9c4b6a4a70

  • SHA256

    ea38c533662b353a9d473e8f59f39de0c23ff1cf3726f676feca800a0c934308

  • SHA512

    c8dddff5ab2f6237177cba4bb50f2ecfe8fd56a5f9b364091385e2a70369cefe1952a5008c55c805a475dcc3621b31a24a282671a01a5e0989a1d7f81fb33cc5

  • SSDEEP

    384:V2jsjFZ+57ZIJe8OTQAdbtBCEWi4GkBLOubTLNCtnG2Be9iqWPosoWZ7:yIj6gOlbBNlFkBLPT+Rwsz

Malware Config

Extracted

Family

cobaltstrike

C2

http://39.99.234.112:2003/cMt9

Attributes
  • user_agent

    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

Targets

    • Target

      ea38c533662b353a9d473e8f59f39de0c23ff1cf3726f676feca800a0c934308

    • Size

      24KB

    • MD5

      e21f3ef3f5c69eb62c15ef87528dbb0d

    • SHA1

      5e7be9b8ab4f154afdca2729cbe6eb9c4b6a4a70

    • SHA256

      ea38c533662b353a9d473e8f59f39de0c23ff1cf3726f676feca800a0c934308

    • SHA512

      c8dddff5ab2f6237177cba4bb50f2ecfe8fd56a5f9b364091385e2a70369cefe1952a5008c55c805a475dcc3621b31a24a282671a01a5e0989a1d7f81fb33cc5

    • SSDEEP

      384:V2jsjFZ+57ZIJe8OTQAdbtBCEWi4GkBLOubTLNCtnG2Be9iqWPosoWZ7:yIj6gOlbBNlFkBLPT+Rwsz

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks