Overview

overview

10

Static

static

10

2cf96acaf7...98.bin

windows7_x64

3

2cf96acaf7...98.bin

windows10-2004_x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2cf96acaf71dfc56df74287d20714e4ff899eef7bf1caffd42180e8cc733ab98.bin

  • Size

    206KB

  • Sample

    220531-j1sc8aeebk

  • MD5

    d9878ceba3d6734cbb5143a3393a9a07

  • SHA1

    4c380b7eecfe5c24671229f15d7cc98e656792b4

  • SHA256

    2cf96acaf71dfc56df74287d20714e4ff899eef7bf1caffd42180e8cc733ab98

  • SHA512

    f8268ca82f84a9e45a7983ff942e4d8dec84d2853ae2337f1bb787fe15d4864f05843d0223fb41470fe41e2fc75c95691d21d37dcde2043df5961c3df1970f79

Score
10/10
cobaltstrike999999

Malware Config

Extracted

Family

cobaltstrike

Botnet

999999

C2

http://service-5j06jxm4-1310110564.hk.apigw.tencentcs.com:80/api/x

Attributes
  • access_type

    512

  • host

    service-5j06jxm4-1310110564.hk.apigw.tencentcs.com,/api/x

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAcAAAAAAAAAAwAAAAIAAAAKU0VTU0lPTklEPQAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAcAAAAAAAAAAwAAAAIAAAAJSlNFU1NJT049AAAABgAAAAZDb29raWUAAAAHAAAAAQAAAAMAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • polling_time

    3000

  • port_number

    80

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCV4tHdMU6ZE1cl3YYecPdjEo/zw4GTxwo4NKJeVBOTjTbstVaTMQHSh2+hqBDqn4zCdVmSoHqCZDFtAqQ022Pf1x0jMlUbFTjIHXFYkeWbQJri6gvSzZ+usWgIFXyjDGPePBdvfAyWhzjStHyGfadImdePY8gj51c37I9teOvjewIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    1.481970944e+09

  • unknown2

    AAAABAAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /api/y

  • user_agent

    Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.0)

  • watermark

    999999

Targets

    • Target

      2cf96acaf71dfc56df74287d20714e4ff899eef7bf1caffd42180e8cc733ab98.bin

    • Size

      206KB

    • MD5

      d9878ceba3d6734cbb5143a3393a9a07

    • SHA1

      4c380b7eecfe5c24671229f15d7cc98e656792b4

    • SHA256

      2cf96acaf71dfc56df74287d20714e4ff899eef7bf1caffd42180e8cc733ab98

    • SHA512

      f8268ca82f84a9e45a7983ff942e4d8dec84d2853ae2337f1bb787fe15d4864f05843d0223fb41470fe41e2fc75c95691d21d37dcde2043df5961c3df1970f79

    Score
    3/10
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks