Overview

overview

10

Static

static

3

aa9b778705...be.dll

windows7-x64

10

aa9b778705...be.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aa9b7787058c20d3c09e4906cf85dd12077311fbb360385fb19acf2572d63abe

  • Size

    24KB

  • Sample

    240914-xwcc4a1anm

  • MD5

    ee7aada6b80832d7a48a942a38317559

  • SHA1

    599b21569b8e8be062303e8ad476f4f886dbe0c5

  • SHA256

    aa9b7787058c20d3c09e4906cf85dd12077311fbb360385fb19acf2572d63abe

  • SHA512

    a5a7cebac2cea38b12a9e983b6eb75dccfaf3dae92cac2d6f3a54a7efae549a27fa581656541984267a79a4ec6d11caada629040983690a96d79886907f4d28f

  • SSDEEP

    384:A6wL584Z+fsGHpXjWXoZVNBCpz0XjjonCvTAlBwMpkvYDt6B:6fa1jWXobNApIXj8n8tMpMOt6

Score
10/10
cobaltstrikebackdoortrojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://119.91.195.178:20961/www/handle/docm

Attributes
  • user_agent

    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E) QQBrowser/6.9.11079.201

Targets

    • Target

      aa9b7787058c20d3c09e4906cf85dd12077311fbb360385fb19acf2572d63abe

    • Size

      24KB

    • MD5

      ee7aada6b80832d7a48a942a38317559

    • SHA1

      599b21569b8e8be062303e8ad476f4f886dbe0c5

    • SHA256

      aa9b7787058c20d3c09e4906cf85dd12077311fbb360385fb19acf2572d63abe

    • SHA512

      a5a7cebac2cea38b12a9e983b6eb75dccfaf3dae92cac2d6f3a54a7efae549a27fa581656541984267a79a4ec6d11caada629040983690a96d79886907f4d28f

    • SSDEEP

      384:A6wL584Z+fsGHpXjWXoZVNBCpz0XjjonCvTAlBwMpkvYDt6B:6fa1jWXobNApIXj8n8tMpMOt6

    Score
    10/10
    cobaltstrikebackdoortrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks