cobaltstrike

General

Target

goopdate.dll
Size

285KB
Sample

220120-rky5tsacd2
MD5

3bb71cef8a643cf00aef4ed04a599b12
SHA1

bf8a77be54fffaca0775b2947e29b46959c010b9
SHA256

c3dfcd55ea3b621537c1d7170212249d3d12f96a08d0e5c2ed1d4f0cf6036eb6
SHA512

82f48dd1f2bab3cb53f9d0127f4dc53a247e5af05a1ae7b7f6271bf1676560305df726c72bd330a387edba86714bfe45b65029720b4faeaf1a10a905fe617a9e

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

305419896

C2

http://104.31.76.215:80/jquery-3.3.2.min.js

http://172.67.168.227:80/jquery-3.3.2.min.js

http://104.31.77.215:80/jquery-3.3.2.min.js

Attributes

access_type
512
dns_idle
1.34744072e+08
host
104.31.76.215,/jquery-3.3.2.min.js,172.67.168.227,/jquery-3.3.2.min.js,104.31.77.215,/jquery-3.3.2.min.js
http_header1
AAAAEAAAABhIb3N0OiBzdGF0aWMubWluaXdpc2UubWUAAAAKAAAAC0FjY2VwdDogKi8qAAAACgAAABZBY2NlcHQtTGFuZ3VhZ2U6IGVuLVVTAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAAAAAAADQAAAAIAAAALc2Vzc2lvbl9pZD0AAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAAEAAAABhIb3N0OiBzdGF0aWMubWluaXdpc2UubWUAAAAKAAAAC0FjY2VwdDogKi8qAAAACgAAABNBY2NlcHQtTGFuZ3VhZ2U6IGVuAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAABAAAADQAAAAQAAAAHAAAAAAAAAA0AAAAFAAAAAmlkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
jitter
8448
maxdns
245
polling_time
37500
port_number
80
sc_process32
%windir%\syswow64\ktmutil.exe
sc_process64
%windir%\sysnative\ktmutil.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCF0Hv1f5APRNApuC/MnRL8V04hCN5gcntJtYm48yXAuZipkyUXHpsUNi1S00duHZ26x62ObQ6fKvEZdG2JopO96tnwbsLSoKAU3ipseIA5tsNrdSWXIl7Gu6arE65eBecdkZ4t3s12EptaiwuoorSSP9rO9yQahF43hN6gsu5ZCQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
9.45165568e+08
unknown2
AAAABAAAAAEAAABRAAAAAgAAAFQAAAACAAAAPQAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/people/donald-j-trump
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
watermark
305419896

Targets

- Target
  
  goopdate.dll
- Size
  
  285KB
- MD5
  
  3bb71cef8a643cf00aef4ed04a599b12
- SHA1
  
  bf8a77be54fffaca0775b2947e29b46959c010b9
- SHA256
  
  c3dfcd55ea3b621537c1d7170212249d3d12f96a08d0e5c2ed1d4f0cf6036eb6
- SHA512
  
  82f48dd1f2bab3cb53f9d0127f4dc53a247e5af05a1ae7b7f6271bf1676560305df726c72bd330a387edba86714bfe45b65029720b4faeaf1a10a905fe617a9e
Score

10^/10

cobaltstrike 305419896 backdoor trojan persistence
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Suspicious use of NtCreateProcessExOtherParentProcess
- Blocklisted process makes network request
- Sets service image path in registry
  persistence
behavioral1 behavioral2