Overview

overview

10

Static

static

10

87d69fecf1...c4.dll

windows10-2004-x64

3

87d69fecf1...c4.dll

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    87d69fecf158f4c8b29220fefb41adf5afcc6edcbc16ddc026602bf55c92bbc4.zip
  • Size 115KB
  • Sample261020-r1bdpsaz21
  • SHA256 c7be590ce5458dc13151c5c0a1e167e76faa5a160e429bbc6b67a193b5685c5b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
cobaltstrike467582005backdoordiscoverytrojan

Malware Config

Extracted

Family

  • cobaltstrike

Botnet

  • 467582005

C2

  • http://ns1.pastcloud.xyz:553/Update/8-3-0/default.jsp

  • http://ns2.pastcloud.xyz:553/Update/8-3-0/default.jsp

Attributes
  • access_type

    512

  • beacon_type

    256

  • host

    ns1.pastcloud.xyz,ns2.pastcloud.xyz

  • http_header1

    AAAACgAAAD1Vc2VyLUFnZW50OiBNb3ppbGxhLzQuMCAoQ29tcGF0aWJsZTsgTVNJRSA2LjA7V2luZG93cyBOVCA1LjEpAAAACgAAABtBY2NlcHQ6ICovKiwgLi4uLCAuLi4uLi4sIC4AAAAHAAAAAAAAAAsAAAAFAAAAA3RtcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAoAAAA9VXNlci1BZ2VudDogTW96aWxsYS80LjAgKENvbXBhdGlibGU7IE1TSUUgNi4wO1dpbmRvd3MgTlQgNS4xKQAAAAcAAAAAAAAAAQAAAAwvZGVmYXVsdC5qc3AAAAAMAAAABwAAAAEAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • maxdns

    255

  • polling_time

    500

  • port_number

    553

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCPmfpTcIEyucc7KBszezHJ9MmjFgHHP1wh03yxHvwpdl0g9vPCQrgL6lnXqqJ0LKFS6QskclnWMsUE4vjQ4vjRo1OtFz0iPB4o3IPxY6WDpiNtohfq+0sNNSZ9/CWAKoKQJmkhml1beygKV6JbZGDqlTH2lhFeS7H8KqF22ZGK2wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /Update/8-3-0/Package

  • user_agent

    Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUS)

  • watermark

    467582005

Targets

    • Target
      87d69fecf158f4c8b29220fefb41adf5afcc6edcbc16ddc026602bf55c92bbc4
    • Size 208KB
    • SHA256 87d69fecf158f4c8b29220fefb41adf5afcc6edcbc16ddc026602bf55c92bbc4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks