Overview

overview

10

Static

static

10

cs.bin.dll

windows7-x64

1

cs.bin.dll

windows10-2004-x64

1

Resubmissions

20/07/2023, 06:46

230720-hjr6fsdg6x 10

27/11/2022, 13:17

221127-qjc1jaae72 10

Sharing

Copy URL Twitter E-mail

General

  • Target

    cs.bin.exe

  • Size

    255KB

  • MD5

    5fe7fe521eccb38da629d35b188d6d18

  • SHA1

    744ae484ea02df2588a5ba0987ede6f4cbc5882f

  • SHA256

    ce9b0e73874f72dce7901b00fa90716b8fd5ccbda4c4560b3a6866acd7ccdddd

  • SHA512

    8eba1e76b69cf4f208645dd8308af03cf238b8bdd50ac9666a3059b5ee57ae27f446bb8e65f5c164b9cee3b584767c4ef0d3acd4160d72bffa8559dd78c56023

  • SSDEEP

    3072:mr+U7LVLn1BFdjGQX8dbDCRUCnhqxmTy1WOeJfUuIRrT10ZFPjEzcuT5wxAgYJuN:mr+USu+WOeOTCjLEIuTtgi+w2

Score
10/10
0cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

0

C2

http://159.223.12.60:80/dz

Attributes
  • access_type

    512

  • host

    159.223.12.60,/dz

  • http_header1

    AAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAAZQWNjZXB0LUVuY29kaW5nOiBnemlwLCBicgAAAAcAAAAAAAAADwAAAAMAAAACAAAANXdvcmRwcmVzc19sb2dnZWRfaW5fMTg3MGE4MjlkOWJjNjlhYmY1MDBlY2E2ZjAwMjQxZmU9AAAABgAAAAZDb29raWUAAAAJAAAAC2dyYW50PWZhbHNlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAATQWNjZXB0LUVuY29kaW5nOiBicgAAAAoAAAAvQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQAAAAHAAAAAQAAAAsAAAADAAAAAgAAAAZwaG90bz0AAAAEAAAABwAAAAAAAAADAAAAAgAAAA5fX3Nlc3Npb25fX2lkPQAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    10496

  • maxdns

    255

  • polling_time

    19506

  • port_number

    80

  • sc_process32

    %windir%\syswow64\runonce.exe

  • sc_process64

    %windir%\sysnative\runonce.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQChMiQ5CKLe76n0aDzYWgdbVN41NzsUX3VHHULF4O0aq5bqjeyM0q9SICkYWgzxPWj6IcNsqyQXAV9lOcH/HZxqfUFl6/dyDxTPvnmau5833UR1acphagCgBJGdyCuAQ90gzI32fcDOFtRuDYTkelV3R9loA6ODEUCuawNMv6vJbQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4.272630272e+09

  • unknown2

    AAAABAAAAAIAAAFSAAAAAwAAAAsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /panel

  • user_agent

    Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202

  • watermark

    0

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • cs.bin.exe
    .dll windows x64

    c7aef98e60a4a98b041b1e6d214850ff


    Headers

    Imports

    Exports

    Sections