Overview

overview

10

Static

static

10

93ecc431c8...bb.dll

windows10-2004-x64

10

93ecc431c8...bb.dll

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    93ecc431c8c7bf3b4dba4a54f7866612c2794a9f3cf3817928f145e7aa252ebb.zip
  • Size 114KB
  • Sample261030-s5tarads91
  • SHA256 fd61559cc863319ce413fcbb776e8e1e20f1fcf690a14d727ae3a49fa930f157
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
0trojanbackdoorcobaltstrike

Malware Config

Extracted

Family

  • cobaltstrike

Botnet

  • 0

C2

  • http://time.vasabii9.com:53/jquery-3.3.1.min.js

  • http://network.vasabii9.com:53/jquery-3.3.1.min.js

  • http://config.vasabii9.com:53/jquery-3.3.1.min.js

Attributes
  • access_type

    512

  • beacon_type

    256

  • dns_idle

    1.908702538e+09

  • host

    time.vasabii9.com,network.vasabii9.com,config.vasabii9.com

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    9472

  • maxdns

    255

  • polling_time

    7300

  • port_number

    53

  • sc_process32

    %windir%\syswow64\svchost.exe -k netsvcs

  • sc_process64

    %windir%\sysnative\svchost.exe -k netsvcs

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCvZHGdVpOgUJ/kjGxNH91XAkzyRv/a18lxyttRsktmERVvCxpi67segP+UcFPhIcoOIn0TnYhds+dwSjO6NdfWkoypknbQuKOKGoeRdBmnchZZryLigS1QY8DOoWo0e6QfdNa0R+i1Vjp5gORL03yW/oqX1kG4uwENBJ1mNGITlwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4.234810624e+09

  • watermark

    0

Signatures

  • Family: Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • 93ecc431c8c7bf3b4dba4a54f7866612c2794a9f3cf3817928f145e7aa252ebb.zip
    .zip 114KB
  • 93ecc431c8c7bf3b4dba4a54f7866612c2794a9f3cf3817928f145e7aa252ebb
    .dll 203KB

93ecc431c8c7bf3b4dba4a54f7866612c2794a9f3cf3817928f145e7aa252ebb.zip

  • SHA256 fd61559cc863319ce413fcbb776e8e1e20f1fcf690a14d727ae3a49fa930f157
  • MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected