Overview

overview

10

Static

static

10

aa75cd7b34...b2.exe

windows7-x64

7

aa75cd7b34...b2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aa75cd7b34d75a9c0723a9908d77fa57c370b62c5cad4e7bcce1369620c35fb2

  • Size

    5.8MB

  • Sample

    240921-h6jgts1cjm

  • MD5

    10768497c987dce8b6ea442cde8749a9

  • SHA1

    cf26cecc487f4554f8577d6c9b24d76a3993c174

  • SHA256

    aa75cd7b34d75a9c0723a9908d77fa57c370b62c5cad4e7bcce1369620c35fb2

  • SHA512

    1c66c3430866a908afba1227f1616bb6f3356aa510798df92b0c852405d9bc9f6e9258c32f7d2e8e3bb0cc4f2cacca0167bfab81487a3387c1f08158cdaca5f5

  • SSDEEP

    98304:0LNWgGAVE7wRhI3l72Qj1oWBg+uoQs+YX5dfX/Rx+HCITxat9MR:0Qg3VE7wfI9jCgYBYvL+iITxavM

Score
10/10
cobaltstrikebackdoorpyinstallertrojanupx

Malware Config

Extracted

Family

cobaltstrike

C2

http://47.239.207.143:8888/q4fR

Attributes
  • user_agent

    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; XBLWP7; ZuneWP7)

Targets

    • Target

      aa75cd7b34d75a9c0723a9908d77fa57c370b62c5cad4e7bcce1369620c35fb2

    • Size

      5.8MB

    • MD5

      10768497c987dce8b6ea442cde8749a9

    • SHA1

      cf26cecc487f4554f8577d6c9b24d76a3993c174

    • SHA256

      aa75cd7b34d75a9c0723a9908d77fa57c370b62c5cad4e7bcce1369620c35fb2

    • SHA512

      1c66c3430866a908afba1227f1616bb6f3356aa510798df92b0c852405d9bc9f6e9258c32f7d2e8e3bb0cc4f2cacca0167bfab81487a3387c1f08158cdaca5f5

    • SSDEEP

      98304:0LNWgGAVE7wRhI3l72Qj1oWBg+uoQs+YX5dfX/Rx+HCITxat9MR:0Qg3VE7wfI9jCgYBYvL+iITxavM

    Score
    10/10
    upxcobaltstrikebackdoortrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks