Overview

overview

10

Static

static

3

c2a4f4a3f5...87.exe

windows7-x64

1

c2a4f4a3f5...87.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c2a4f4a3f5e33f95c3b55ea0c003493f17885f30a8311044ab87450ac2cfa787

  • Size

    2.4MB

  • Sample

    250328-v4taga1lv4

  • MD5

    60bfa4bdc6c2a34e3cb7467676581915

  • SHA1

    b874f048f6dec0da1333c7f39a9650bbd6018b37

  • SHA256

    c2a4f4a3f5e33f95c3b55ea0c003493f17885f30a8311044ab87450ac2cfa787

  • SHA512

    ab755b5b57d0cc0da4567acb66a0f0cab057ecbff1eef0886bfe4fb4792453b39cc4d60020ec6855bc9b8f29a5e68f0e69dc57ae9e1624f0717851af8b28db03

  • SSDEEP

    49152:uZhBWp5DfoejE9PnsFYxZuzNY2LodeGDWU:GhBWp57od9EexwRhLo4GDZ

Score
10/10
cobaltstrike100000backdoordiscoverytrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000

C2

http://113.45.140.119:80/visit.js

Attributes
  • access_type

    512

  • host

    113.45.140.119,/visit.js

  • http_header1

    AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • polling_time

    60000

  • port_number

    80

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCSUrGN7hLyGmd8+THYMxuGnFsO2j+BtzhIDHy3GxOKIEfkMEyvzq0cIdqwmo8VzveJ3CgUAm6ssSv7YygDYouYZxsb7ceQX+MKR7VNpCTcemh5108jtVwLJc5Vo0IKrfEmCRmDtaIqFC0bEqTzx4/jLsB/xKCM8lXF7Z68yMRWwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit.php

  • user_agent

    Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; Avant Browser)

  • watermark

    100000

Targets

    • Target

      c2a4f4a3f5e33f95c3b55ea0c003493f17885f30a8311044ab87450ac2cfa787

    • Size

      2.4MB

    • MD5

      60bfa4bdc6c2a34e3cb7467676581915

    • SHA1

      b874f048f6dec0da1333c7f39a9650bbd6018b37

    • SHA256

      c2a4f4a3f5e33f95c3b55ea0c003493f17885f30a8311044ab87450ac2cfa787

    • SHA512

      ab755b5b57d0cc0da4567acb66a0f0cab057ecbff1eef0886bfe4fb4792453b39cc4d60020ec6855bc9b8f29a5e68f0e69dc57ae9e1624f0717851af8b28db03

    • SSDEEP

      49152:uZhBWp5DfoejE9PnsFYxZuzNY2LodeGDWU:GhBWp57od9EexwRhLo4GDZ

    Score
    10/10
    cobaltstrike100000backdoordiscoverytrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks