cobaltstrike

General

Target
a06fad7e1fc493b5b0d12c67520b06add25ccd68ac8c5b8d36b9227d69e4036f
Size 149KB
Sample220131-zpkr1acda9
SHA256 a06fad7e1fc493b5b0d12c67520b06add25ccd68ac8c5b8d36b9227d69e4036f
MD5 7b740eff74e7cc365af947fa20e035dc
SHA1 fccb71ebacefcdf84e6d7607455708380292c65c
SHA512 c511854b458e76a4eebd0419d1667ea4498f1fe635ffdc7c763fa85f82a452f32eec5d168cbcd662fc6421f9cf13a6502a4d8e41d35b53a439e95c42d17d3d84
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

C2

http://rowomuhona.com:443/components/search.mp3

Attributes

user_agent
Host: facebook.com Connection: close Accept-Encoding: gzip, br Accept-Language: fr-CH, fr;q=0.9, en;q=0.8, de;q=0.7, *;q=0.5 User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202

Extracted

Family

cobaltstrike

Botnet

1580103814

C2

http://rowomuhona.com:443/remove

Attributes

access_type
512
beacon_type
2048
host
rowomuhona.com,/remove
http_header1
AAAAEAAAABJIb3N0OiBmYWNlYm9vay5jb20AAAAKAAAAEUNvbm5lY3Rpb246IGNsb3NlAAAABwAAAAAAAAANAAAAAwAAAAIAAAAYd3Bfd29vY29tbWVyY2Vfc2Vzc2lvbl89AAAABgAAAAZDb29raWUAAAAJAAAACnBhZ2VzPXRydWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAAEAAAABJIb3N0OiBmYWNlYm9vay5jb20AAAAKAAAAEUNvbm5lY3Rpb246IGNsb3NlAAAACgAAABhDb250ZW50LVR5cGU6IHRleHQvcGxhaW4AAAAHAAAAAQAAAAgAAAADAAAABAAAAAcAAAAAAAAAAwAAAAIAAAAOX19zZXNzaW9uX19pZD0AAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
2048
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCEMUP4ChFxVGORmjbR1sXIYbI+z/22zA+ehSyyLpb+1DApoGDMfJerUXxSPP4BLKIvLgei9Dhg8JMSO75lKFlyBZWo/CEQlGKcfiHrjglYrLWKi1ps7h9n7OwLNl6jgGsdQjA+8pKRrKwQEg1JtrX35RXoVYJboDb0EWL4q+3kKQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4.272630272e+09
unknown2
AAAABAAAAAIAAAFSAAAAAwAAAAsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/ku
user_agent
Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202
watermark
1580103814

Targets

- Target
  a06fad7e1fc493b5b0d12c67520b06add25ccd68ac8c5b8d36b9227d69e4036f
- Size 149KB
- SHA256 a06fad7e1fc493b5b0d12c67520b06add25ccd68ac8c5b8d36b9227d69e4036f
- MD5 7b740eff74e7cc365af947fa20e035dc
- SHA1 fccb71ebacefcdf84e6d7607455708380292c65c
- SHA512 c511854b458e76a4eebd0419d1667ea4498f1fe635ffdc7c763fa85f82a452f32eec5d168cbcd662fc6421f9cf13a6502a4d8e41d35b53a439e95c42d17d3d84
- MD5 SHA1 SHA512
Score

10^/10

cobaltstrike 1580103814 backdoor trojan persistence
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Sets service image path in registry
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Sets service image path in registry

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2