cobaltstrike

General

Target

a3af3d7e825daeffc05e34a784d686bb9f346d48a92c060e1e901c644398d5d7.exe
Size

101KB
Sample

210225-7whvkh8qme
MD5

580c37831fe98a254eb6c61c692c70d8
SHA1

af8f9344a1ae56e0b83146f9a099e98d944b3be1
SHA256

a3af3d7e825daeffc05e34a784d686bb9f346d48a92c060e1e901c644398d5d7
SHA512

8d0798b3e59a1784e2a8929074ad9a6ad5441197a49c6fad3b51637481cc15ea2bb9ab941c5d00e134758840cae9019f02f77705631b59d1e3dcf10a0d91aa94

Score

10^/10

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://121.37.139.238:443/JMLy

Extracted

Family

cobaltstrike

C2

http://121.37.139.238:443/ga.js

Attributes

access_type
512
beacon_type
2048
host
121.37.139.238,/ga.js
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
polling_time
60000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDo3WGxIuFUQ+k1xANyFXZ0lhEaD1KLHwpI0NuVWE+CvHpqFVb4GeWPsejVk+4aJc1YykPsIStgVGNgbaST68LpENb7PzK1rAbX6kvI8o90LC9hGO7YCuFCerkQ9fr/XKJDhPG6z7RhP2xVEJS1F0G2ESTqwpQds4jb31NMAdjr7wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ESES)

Targets

- Target
  
  a3af3d7e825daeffc05e34a784d686bb9f346d48a92c060e1e901c644398d5d7.exe
- Size
  
  101KB
- MD5
  
  580c37831fe98a254eb6c61c692c70d8
- SHA1
  
  af8f9344a1ae56e0b83146f9a099e98d944b3be1
- SHA256
  
  a3af3d7e825daeffc05e34a784d686bb9f346d48a92c060e1e901c644398d5d7
- SHA512
  
  8d0798b3e59a1784e2a8929074ad9a6ad5441197a49c6fad3b51637481cc15ea2bb9ab941c5d00e134758840cae9019f02f77705631b59d1e3dcf10a0d91aa94
Score

10^/10

cobaltstrike metasploit backdoor trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
behavioral1