cobaltstrike

General

Target

eqvndtnbemhkngehdzydcbl.dll
Size

531KB
Sample

221201-zb1ajace5y
MD5

4716051f9682ec53fbb4b7174c9eded6
SHA1

ba1775a1497fe921437bacf6a5300d3580da6f67
SHA256

ebdaf15e6d155acb3f4b3f5b2d2a50ce7b5f93a429e14c52811a5e87b1dd33a6
SHA512

537abb9402bd48a8a6a9cfc8a37dd0e6ecab47f8fa5d922c8b41a39935776ff02b71b8501c51bfe957f1e3a32b5f2a0821f455217566da91e9b87f8bbdb8ce4e
SSDEEP

6144:k+OWEHlFBf4loGZwUer95cpWdyy3eYYK951nHhZXnoxfYSqgr3orFURt3ih4rIrt:keAjSmG2Uu6E0ueGoxtqGpXzrEJG

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

426352781

C2

http://194.165.16.57:4545/mark

Attributes

access_type
512
beacon_type
2048
host
194.165.16.57,/mark
http_header1
AAAAEAAAAA9Ib3N0OiBmeHBhZS5jb20AAAAKAAAAEUNvbm5lY3Rpb246IGNsb3NlAAAABwAAAAAAAAAIAAAAAwAAAAIAAAAFQ0ZSUz0AAAAGAAAABkNvb2tpZQAAAAkAAAAKY2FzdD1mYWxzZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAAEAAAAA9Ib3N0OiBmeHBhZS5jb20AAAAKAAAAEUNvbm5lY3Rpb246IGNsb3NlAAAACgAAAD1BY2NlcHQtTGFuZ3VhZ2U6IGZyLUNILCBmcjtxPTAuOSwgZW47cT0wLjgsIGRlO3E9MC43LCAqO3E9MC41AAAACgAAABhDb250ZW50LVR5cGU6IHRleHQvcGxhaW4AAAAHAAAAAQAAAA8AAAADAAAABAAAAAcAAAAAAAAAAwAAAAIAAAAOX19zZXNzaW9uX19pZD0AAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
12032
polling_time
20
port_number
4545
sc_process32
%windir%\syswow64\wusa.exe
sc_process64
%windir%\sysnative\wusa.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMjozbuQNRBNQr5Y5lx67ZWqOBh6YAbbunF2D6/9cAqbH96R4OvOuXqjNkrf4pdC1wzSri5q4AEotCkvT2iBCaLSArHM8W2rPzSBIgb+qd0qTonbr3+8AUnyEB8iRv0W/Iio08v2CrtKRdkATPP/PzhER4BVnHapsP5KighczRgQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
5.44480256e+08
unknown2
AAAABAAAAAIAAAJYAAAAAwAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/execute
user_agent
Mozilla/5.0 (Linux; Android 7.1.2; Redmi 4A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36
watermark
426352781

Targets

- Target
  
  eqvndtnbemhkngehdzydcbl.dll
- Size
  
  531KB
- MD5
  
  4716051f9682ec53fbb4b7174c9eded6
- SHA1
  
  ba1775a1497fe921437bacf6a5300d3580da6f67
- SHA256
  
  ebdaf15e6d155acb3f4b3f5b2d2a50ce7b5f93a429e14c52811a5e87b1dd33a6
- SHA512
  
  537abb9402bd48a8a6a9cfc8a37dd0e6ecab47f8fa5d922c8b41a39935776ff02b71b8501c51bfe957f1e3a32b5f2a0821f455217566da91e9b87f8bbdb8ce4e
- SSDEEP
  
  6144:k+OWEHlFBf4loGZwUer95cpWdyy3eYYK951nHhZXnoxfYSqgr3orFURt3ih4rIrt:keAjSmG2Uu6E0ueGoxtqGpXzrEJG
Score

10^/10

cobaltstrike 426352781 backdoor trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

Score

N/A

behavioral1

cobaltstrike426352781backdoortrojan

Score

10^/10

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Matrix

Tasks

static1

behavioral1