cobaltstrike

General

Target
CustomerStatement.exe
Size 595KB
Sample210225-gzmtcl448s
SHA256 dbafbe9edfdac67a781756a6970a7341fd5401b0914fff7e3e8136cff0426fc5
MD5 93498547113a518da19d5d7b38599e82
SHA1 8abc82ea38eb9d625c715385f76b727fd661fa52
SHA512 c74653c39cfdf0887bf4d8cea348629936abacb6233e8876084cfeea955316a487f34dd9667359548f1a219d304b778d110ba538c9d0ff1e609367e347014fdc
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Version

windows/download_exec

C2

http://redwelt.com:443/files/links.gif

Extracted

Family

cobaltstrike

C2

http://redwelt.com:443/eso.js

Attributes

access_type
512
beacon_type
2048
host
redwelt.com,/eso.js
http_header1
AAAAEAAAABFIb3N0OiBuZXRmbGl4LmNvbQAAAAoAAAARQ29ubmVjdGlvbjogY2xvc2UAAAAKAAAAEkFjY2VwdDogaW1hZ2UvanBlZwAAAAoAAAAZQWNjZXB0LUVuY29kaW5nOiBnemlwLCBicgAAAAcAAAAAAAAACwAAAAMAAAACAAAAA2x1PQAAAAYAAAAGQ29va2llAAAACQAAAA1sb2dvcG5nPWZhbHNlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAAEAAAABFIb3N0OiBuZXRmbGl4LmNvbQAAAAoAAAARQ29ubmVjdGlvbjogY2xvc2UAAAAKAAAAGUFjY2VwdC1FbmNvZGluZzogZ3ppcCwgYnIAAAAKAAAAL0NvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkAAAABwAAAAEAAAALAAAAAwAAAAIAAAAEbWQ1PQAAAAQAAAAHAAAAAAAAAAMAAAACAAAADl9fc2Vzc2lvbl9faWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
2048
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\mstsc.exe
sc_process64
%windir%\sysnative\mstsc.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCZU6EkkcUA1x4nkMMpV8QSWi8OreQbl2NCmIIh+Hiyh6rrDaIZUqqUY1TGdlGU+44tOpuOxkGotIkQl3QOE+O0RcVd863WTN8gt/9SfGG4SNVDE9w2ewYFpfE71tXkaS7MMp7+4yK/RbJ36UkaYxPkoC/riLCwasoBElZTk9/EmwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4.9795328e+08
unknown2
AAAABAAAAAIAAANxAAAAAwAAAAsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/af
user_agent
Mozilla/5.0 (Linux; Android 7.0; Pixel C Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0

Targets

- Target
  CustomerStatement.exe
- Size 595KB
- SHA256 dbafbe9edfdac67a781756a6970a7341fd5401b0914fff7e3e8136cff0426fc5
- MD5 93498547113a518da19d5d7b38599e82
- SHA1 8abc82ea38eb9d625c715385f76b727fd661fa52
- SHA512 c74653c39cfdf0887bf4d8cea348629936abacb6233e8876084cfeea955316a487f34dd9667359548f1a219d304b778d110ba538c9d0ff1e609367e347014fdc
- MD5 SHA1 SHA512
Score

10^/10

cobaltstrike backdoor trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2