Overview

overview

10

Static

static

3

84a40c89fb...ca.exe

windows10-2004-x64

10

84a40c89fb...ca.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    84a40c89fbcce712029992e0fa7e4ad62b71eb86392517002e40136bc056fdca
  • Size 3.0MB
  • Sample260831-cracqatdlf
  • SHA256 84a40c89fbcce712029992e0fa7e4ad62b71eb86392517002e40136bc056fdca
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
cobaltstrike987654321backdoortrojan

Malware Config

Extracted

Family

  • cobaltstrike

Botnet

  • 987654321

C2

  • http://leet.kdns.fr:443/api/v1/session/heartbeat

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    leet.kdns.fr

  • http_header1

    AAAAEAAAABJIb3N0OiBsZWV0LmtkbnMuZnIAAAAKAAAAKUFjY2VwdDogYXBwbGljYXRpb24vanNvbiwgdGV4dC9wbGFpbiwgKi8qAAAACgAAAB9BY2NlcHQtTGFuZ3VhZ2U6IGVuLVVTLGVuO3E9MC45AAAACgAAABZDb25uZWN0aW9uOiBrZWVwLWFsaXZlAAAACgAAAHtVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTI2LjAuMC4wIFNhZmFyaS81MzcuMzYAAAAHAAAAAAAAAA0AAAACAAAAB3Nlc3NpZD0AAAABAAAADjsgU2FtZVNpdGU9TGF4AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAAEAAAABJIb3N0OiBsZWV0LmtkbnMuZnIAAAAKAAAALUNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24vanNvbjsgY2hhcnNldD11dGYtOAAAAAoAAAB7VXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyNi4wLjAuMCBTYWZhcmkvNTM3LjM2AAAABwAAAAAAAAANAAAABgAAAAxYLVJlcXVlc3QtSWQAAAAHAAAAAQAAAA0AAAACAAAABnsicCI6IgAAAAEAAAACIn0AAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    2560

  • month

    3.3554432e+07

  • polling_time

    5000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\werfault.exe

  • sc_process64

    %windir%\sysnative\werfault.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCsW6Iy//DZ6a21su+TiJq1oeq+SJ3ug7GiJKl3uCwdaANjyGetfgYRN7jZ0fmc8iKRFcW7aYWAnwfles3jeZ9aLiTKkhg+H3/3y+gdG7PpSOAi/4tBXseAc/NJf6B251ZGhiyIOT67y6O/jWK9zP9hfAts+RdAwp97yHQAeayA1wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    2.136282368e+09

  • unknown2

    AAAABAAAAAEAAAASAAAAAgAAABcAAAANAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /api/v1/session/report

  • user_agent

    Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)

  • watermark

    987654321

Targets

    • Target
      84a40c89fbcce712029992e0fa7e4ad62b71eb86392517002e40136bc056fdca
    • Size 3.0MB
    • SHA256 84a40c89fbcce712029992e0fa7e4ad62b71eb86392517002e40136bc056fdca
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    backdoor987654321cobaltstriketrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks