Overview

overview

10

Static

static

3

78201772a7...c6.exe

windows7-x64

10

78201772a7...c6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    78201772a7971266f80873aa22ea745ccb937820994e45e1b10fe59da3db11c6

  • Size

    4.9MB

  • Sample

    240925-x33tmataml

  • MD5

    7e7ff11b0d625063e27adff0df1ee1f7

  • SHA1

    de5ea272578a1923a3a3fc280114f30cce32e169

  • SHA256

    78201772a7971266f80873aa22ea745ccb937820994e45e1b10fe59da3db11c6

  • SHA512

    ad7b2489472877abec2cbe8642c776685b21b641e49b3bc1c4917974393b5706811836a2ad366df3aebb944f9437b825a57d854753dd233ead6b0c3195a7b0a4

  • SSDEEP

    98304:32BgFlIxDGj1cK7ggczHBC8Z+9gXVhA30JssDchwMQ7qFp5NW/z0B:3Y6j1cMczA8+9gXVa30WsDcSMt/W7u

Score
10/10
cobaltstrikebackdoorpyinstallertrojanupx

Malware Config

Extracted

Family

cobaltstrike

C2

http://103.214.174.101:10443/LVfU

Attributes
  • user_agent

    User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.101

Targets

    • Target

      78201772a7971266f80873aa22ea745ccb937820994e45e1b10fe59da3db11c6

    • Size

      4.9MB

    • MD5

      7e7ff11b0d625063e27adff0df1ee1f7

    • SHA1

      de5ea272578a1923a3a3fc280114f30cce32e169

    • SHA256

      78201772a7971266f80873aa22ea745ccb937820994e45e1b10fe59da3db11c6

    • SHA512

      ad7b2489472877abec2cbe8642c776685b21b641e49b3bc1c4917974393b5706811836a2ad366df3aebb944f9437b825a57d854753dd233ead6b0c3195a7b0a4

    • SSDEEP

      98304:32BgFlIxDGj1cK7ggczHBC8Z+9gXVhA30JssDchwMQ7qFp5NW/z0B:3Y6j1cMczA8+9gXVa30WsDcSMt/W7u

    Score
    10/10
    cobaltstrikebackdoortrojanupx

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks