Overview

overview

10

Static

static

3

.qq/Deskto...64.dll

windows10-1703-x64

10

.qq/StartDes.exe

windows10-1703-x64

10

某学校�...cx.lnk

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    某学校老师大尺度照片.zip

  • Size

    446KB

  • Sample

    240923-dg72nsvbpe

  • MD5

    4dc4a54e3adb832f28339910220c44b2

  • SHA1

    2b075417c32a15f8feece359bc58e3253038916d

  • SHA256

    4db3e39a2d847ce6902247c689b0dce0da738c31333dc52f02e2a90e76ba2769

  • SHA512

    6fc2d5569fb7660e66f0e48126382b1abc9dcabe8082dee879fe7165ff5bbc288de07d00a999f96650eaf75b11461cb5380bc3d730be7ab69b5984990c88e7c2

  • SSDEEP

    12288:jKo4wsPvltqneyGcPsciB377fc1fzuBXUQRWo5BW5Gy:KDPvltUeKUci97kiVWx5R

Score
10/10
cobaltstrike391144938backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

391144938

C2

http://1.94.24.185:443/cm

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    1.94.24.185,/cm

  • http_header1

    AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • polling_time

    60000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCMsDqm9W6IsM1H0kwwouCSdOtfKtrdgLGrIAur9uDZu9k5rpwy+tY+2PoFsVItxEES0aliTdBvGxtn9JUqMka9wqIbprDB5RE3rHM+V2dUqaZTKhASck1NdefeIOPddsfPQJEi01z0Fys6ZP7Ls7w8W5k75mc9QTvHFZMcgnj0iwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit.php

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20120121 Firefox/46.0

  • watermark

    391144938

Targets

    • Target

      .qq/DesktopProjection64.dll

    • Size

      483KB

    • MD5

      cc2829cbce0eac7202524687f51643fb

    • SHA1

      79925837968278b44eb3da99bd5f6bf7490c8ca6

    • SHA256

      b34884300283556e77ad03641691f34a94609b4be07b5e9b54b6792f25772222

    • SHA512

      217c843a0ee8b660c5647fa389beb28202e0bcbfc3eb840ee4cb694b630d4a109059a563c445fe8ccc19146d96bb8d134ae552bb49cccc86bb2fe6835d32ef65

    • SSDEEP

      6144:jYktUr20/smYnaThZjbT+U+DmTxsFeON88saHwCgPizPjw5E/RZJJvOyr6L1GXl7:jB0XfTOU2iunaMZgPK8G/3bOyrg1Wprz

    Score
    10/10
    cobaltstrike391144938backdoortrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Blocklisted process makes network request

    behavioral1

    • Target

      .qq/StartDes.exe

    • Size

      239KB

    • MD5

      a2e851b21dcb07976fdf4baf79482bd8

    • SHA1

      b99f46321dd8f9ac0fe2e92a1186570d9414cac2

    • SHA256

      a4f9aaaddfe38f6ba5144fde3f6579a896e9f60aee788c7be61eb31ae98764a6

    • SHA512

      c88ef6d11286032c95b8001242a063766a21cc16c574675f37e31c29734966883478fa4e4f8ac53c8ea1c3cd5bb644f4cd70f8427a93920c821a14c03348b635

    • SSDEEP

      3072:Bk4uUHFaomwE/eGW3+9AmDRyaijQaKGaeotadHjKr9le37XzK3L3ZsgH:BVuMFaBZs+emgRQGTjEliXzuL3Og

    Score
    10/10
    cobaltstrike391144938backdoortrojan
    behavioral2

    • Target

      某学校老师大尺度照片.docx.lnk

    • Size

      1KB

    • MD5

      7827df6cbcb26d312fe460969e575961

    • SHA1

      f0f1ab0eebc1e8742c46dd5b274ff81c31d9a11a

    • SHA256

      26503e34c6a6c223a97e8474be2ceddb595ca186818ea32350fdf04fa0452532

    • SHA512

      6e25ba5101f2d6ed2d7e15165db78fce91864e07d2509e12010e90fc5f83d8d43550578e522c51c37e1a42e6e0c19c29304b6c065203e8979d17ed556bd467d9

    Score
    10/10
    cobaltstrike391144938backdoortrojan
    behavioral3

MITRE ATT&CK Enterprise v15

Tasks