Overview

overview

10

Static

static

3

4903bced62...97.exe

windows10-2004-x64

10

4903bced62...97.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    4903bced62dd7def443130be9394f19ff7d09dc2df6d6f1ba6048a68e5c67897
  • Size 1.6MB
  • Sample261002-by5a1atv2r
  • SHA256 4903bced62dd7def443130be9394f19ff7d09dc2df6d6f1ba6048a68e5c67897
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
cobaltstrike987654321backdoortrojan

Malware Config

Extracted

Family

  • cobaltstrike

Botnet

  • 987654321

C2

  • http://31.210.50.153:80/object_vars/user/70229701/user_role_json.jsp

Attributes
  • access_type

    512

  • host

    31.210.50.153

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAfQWNjZXB0LUxhbmd1YWdlOiBlbi1VUyxlbjtxPTAuNQAAAAoAAAAiQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlLCBicgAAAAoAAAAMVEU6IHRyYWlsZXJzAAAACgAAACBYLVJlcXVlc3RlZC1XaXRoOiBYTUxIdHRwUmVxdWVzdAAAAAcAAAAAAAAADwAAAA0AAAACAAAAZkpTRVNTSU9OSUQ9TjNNR0ZYQk9YUjk0WUswOUdVNUNTWEc5RDdTSkg3UU07IHZjPTYxNDEwMjk1MDc1NjMyNjI2ODsgdmNUaW1lc3RhbXA9NTg4MTcxOTIzNzc5NDsgQVdTRUxCPQAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAfQWNjZXB0LUxhbmd1YWdlOiBlbi1VUyxlbjtxPTAuNQAAAAoAAAAiQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlLCBicgAAAAoAAAAeQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi9qc29uAAAACgAAABlYLVJlcXVlc3RlZC1XaXRoOiBicm93c2VyAAAABwAAAAAAAAAPAAAAAwAAAAIAAAA5ZGV2aWNlSWQ9MjcxZDBjODItMjMxMi00MjExLWIzODAtMDEwM2NlZGU5M2EwOyBhcHBGYW1pbHk9AAAAAQAAAAE7AAAABgAAAAp4LW1ldGEtYXBwAAAABwAAAAEAAAAPAAAAAwAAAAIAAAAfeyJwcmV2aW91c0NvbnRleHQiOnsicGluY29kZSI6IgAAAAEAAAAlIiwic291cmNlIjoiIn0sImN1cnJlbnRDb250ZXh0IjpudWxsfQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    9728

  • polling_time

    10291

  • port_number

    80

  • sc_process32

    %windir%\syswow64\cmdl32.exe

  • sc_process64

    %windir%\sysnative\wecutil.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCOSztURksVjfIA4TnZE3ohMSestw87hnKBMl/Ze+l/tDI2+06L5neAGEBMsA8PdynxdmeIJFt3xVZvps1T8Ey/KsrpoPQifmo550cCz2DhZO3yU+VVaxZrbQfipO5+cIMgE3YQG6qc8TJ1OJ7l3Q0HHjCCUetvUOXNOof9kFLTIwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    2.203456768e+09

  • unknown2

    AAAABAAAAAEAAADQAAAAAgAAAFgAAAANAAAADwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /gateway/v1/user/92648722/locationContext

  • user_agent

    Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36

  • watermark

    987654321

Targets

    • Target
      4903bced62dd7def443130be9394f19ff7d09dc2df6d6f1ba6048a68e5c67897
    • Size 1.6MB
    • SHA256 4903bced62dd7def443130be9394f19ff7d09dc2df6d6f1ba6048a68e5c67897
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    backdoor987654321cobaltstriketrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks