Overview

overview

10

Static

static

3

96a9f0c93d...bb.dll

windows10-2004-x64

10

96a9f0c93d...bb.dll

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    96a9f0c93db3a46322fde6548a4aba3e537533e6e36ae29c980913c628f0acbb
  • Size 485KB
  • Sample260907-hfl52afc75
  • SHA256 96a9f0c93db3a46322fde6548a4aba3e537533e6e36ae29c980913c628f0acbb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
cobaltstrike297099651backdoortrojan

Malware Config

Extracted

Family

  • cobaltstrike

Botnet

  • 297099651

C2

  • http://ads-461.global.ssl.fastly.net:443/gtag/js

  • http://advert-581.global.ssl.fastly.net:443/auth/analytics.readonly

  • http://alphabet-106.global.ssl.fastly.net:443/analytics/v3/data/ga

  • http://alphabet-482.global.ssl.fastly.net:443/gtag/js

  • http://alphabet-604.global.ssl.fastly.net:443/gtag/js

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    ads-461.global.ssl.fastly.net,advert-581.global.ssl.fastly.net,alphabet-106.global.ssl.fastly.net,alphabet-482.global.ssl.fastly.net,alphabet-604.global.ssl.fastly.net

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAgQWNjZXB0LUxhbmd1YWdlOjogZW4tR0IsZW47cT0wLjUAAAAKAAAAZ1JlZmVyZXI6IGh0dHBzOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP3NvdXJjZT1ocCZnc19sY3A9Q2dad2Mza3RZV0lRQTFDTkFsaS0mc2NsaWVudD1wc3ktYWImdmVkPSZ1YWN0PTUAAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADQAAAAUAAAAGZ3NfbHBjAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACQAAAAp0PXBhZ2V2aWV3AAAACQAAAARqZT0wAAAACQAAAAxfdT1ZQURBQUVBQn4AAAAKAAAAFkFjY2VwdDogaW1hZ2Uvd2VicCwqLyoAAAAKAAAAH0FjY2VwdC1MYW5ndWFnZTogZW4tR0IsZW47cT0wLjUAAAAKAAAAEUNvbm5lY3Rpb246IGNsb3NlAAAACgAAACBSZWZlcmVyOiBodHRwczovL3d3dy5nb29nbGUuY29tLwAAAAcAAAAAAAAABQAAAANhaXAAAAAHAAAAAQAAAA0AAAACAAAACXRyYWNraW5nPQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    14592

  • polling_time

    37000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\gpupdate.exe

  • sc_process64

    %windir%\sysnative\gpupdate.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCNcWX0PvzsyoVXY9DSkf6RP4/285/uunRWJQRbcKTzij2Z1hSt2rQ8M566wXzc7g4D1kk4VKGQ+XXp2Jrk7weNJoPzP3EP3M0sB6nx+ENdBHqWkz92Xq3M8e6oyW8PC19h/80k+uYgQ4FwHEVmo5hKGR6SoH8ftLptFGMVV8mv3wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    1.084953856e+09

  • unknown2

    AAAABAAAAAEAADizAAAAAgAAHTcAAAANAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /v4/reports

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36

  • watermark

    297099651

Targets

    • Target
      96a9f0c93db3a46322fde6548a4aba3e537533e6e36ae29c980913c628f0acbb
    • Size 485KB
    • SHA256 96a9f0c93db3a46322fde6548a4aba3e537533e6e36ae29c980913c628f0acbb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    backdoor297099651cobaltstriketrojan

    • Family: Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks