Overview

overview

10

Static

static

3

46e24f3ccc...c8.exe

windows7-x64

10

46e24f3ccc...c8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    46e24f3ccc7523ffce39877a1d908ac8.virus

  • Size

    281KB

  • Sample

    240917-txs6fsserc

  • MD5

    46e24f3ccc7523ffce39877a1d908ac8

  • SHA1

    16a99a38bb77249710fddff1f81ab358cc65e58c

  • SHA256

    edd35ed97c31389b31dea02cd393fc2190e82f88bbc2dc9eafdfcf08c5432ce5

  • SHA512

    7c18055720c0dfba0e398de9c82c3f977f67205947f4b31c2e872a82662a532efbc69b84f0c2871787b65b77868826d445bfe72db5dd4fe25c5da0bf6c86c448

  • SSDEEP

    3072:e/YFqR/0kwf1v1InbObmDtAH+zmqDDFwAAJ3AXIWaR7YGyhds/zk8tCdbHzQxqq:eas0kwibrE+zm49AJ3AXIXRSdTz

Score
10/10
cobaltstrike0305419896backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

305419896

C2

http://192.168.242.129:80/__utm.gif

Attributes
  • access_type

    512

  • host

    192.168.242.129,/__utm.gif

  • http_header1

    AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • maxdns

    255

  • polling_time

    60000

  • port_number

    80

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCc1lBesucEcG6ft3t02M+pqLGtYuYSpjOmDMYEgpmr0/h74PVozHzAKtfmtsq3oLWMoT8rHRRJdqchg+jPWm36VO0MGLgKawS2L/rceW0pYSUrdtdbxOsrrzGqq2eM/dq+DlyT6LtIG+2b15e0ssEE2SKUMp9fM08vUwDwSUoJ0wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit.php

  • user_agent

    Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MDDRJS)

  • watermark

    305419896

Extracted

Family

cobaltstrike

Botnet

0

Attributes
  • watermark

    0

Targets

    • Target

      46e24f3ccc7523ffce39877a1d908ac8.virus

    • Size

      281KB

    • MD5

      46e24f3ccc7523ffce39877a1d908ac8

    • SHA1

      16a99a38bb77249710fddff1f81ab358cc65e58c

    • SHA256

      edd35ed97c31389b31dea02cd393fc2190e82f88bbc2dc9eafdfcf08c5432ce5

    • SHA512

      7c18055720c0dfba0e398de9c82c3f977f67205947f4b31c2e872a82662a532efbc69b84f0c2871787b65b77868826d445bfe72db5dd4fe25c5da0bf6c86c448

    • SSDEEP

      3072:e/YFqR/0kwf1v1InbObmDtAH+zmqDDFwAAJ3AXIWaR7YGyhds/zk8tCdbHzQxqq:eas0kwibrE+zm49AJ3AXIXRSdTz

    Score
    10/10
    cobaltstrike0305419896backdoortrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks