Overview

overview

10

Static

static

10

30986e7ff3...1f.exe

windows7-x64

10

30986e7ff3...1f.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    30986e7ff3278b86aac5674839e46d43ba5a3043d7c72b5645fdd6feca39261f

  • Size

    220KB

  • MD5

    ba7bd2502b5bd974fd63e36d46678c1a

  • SHA1

    19a113407d22751dbc2fa76f28da0fad1f699efb

  • SHA256

    30986e7ff3278b86aac5674839e46d43ba5a3043d7c72b5645fdd6feca39261f

  • SHA512

    38cacfc029c7afd98912056f9304bd5b54269ba9ed5ccedb5b7bb6c44fd3dc527a45637bd9f3c285dd98c94a80fd4ad8859de1cc7c82677e0be71ebff188fb7a

  • SSDEEP

    6144:yb83JH8NRBP9zmLaHjFdtEBK2FfNZdX0Wz+7DMF:JyPEaHjFd6M25DdX0Wz+EF

Score
10/10
48312553cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

48312553

C2

http://167.99.117.21:443/assorted/new/0q/ajaxLoad/

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    167.99.117.21,/assorted/new/0q/ajaxLoad/

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAABAAAAAVSG9zdDogd3d3Lm55dGltZXMuY29tAAAABwAAAAAAAAACAAAAFDdidmljNTQ5d21xam8yNTd4eDZpAAAAAgAAAApuOWJuMzhnbzkzAAAACwAAAAIAAAAGVE9LRU49AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAvQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQAAAAQAAAAEUhvc3Q6IG55dGltZXMuY29tAAAACQAAABRkaD1PMzZYV0NPTk1aR0w5VFlBMgAAAAcAAAAAAAAABQAAAAJ2dgAAAAcAAAABAAAAAgAAABtaQy5ZOEUyUjNPOVJORVNaR0gwQU1JWVJFMy8AAAADAAAACAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    7424

  • polling_time

    15

  • port_number

    443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDNSVUA1FhpJUVMgQ3Izfj58IgLTBNeBjhHlhnNzWd/kvFz1fNYNb8/v3Sbp+QdDQfkRUPSt6vhsuyIJaT5GIUPVGl6MBwLAYjtI44Mw3Qp72UKXzxZ8UL0+BiIg+/Am0jU2b5alzsps6PQhQeDot2GfV7AuVFbguXo3DUGpKD1OQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /image/memes/c/07/

  • user_agent

    Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727)

  • watermark

    48312553

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 30986e7ff3278b86aac5674839e46d43ba5a3043d7c72b5645fdd6feca39261f
    .exe windows x86

    829da329ce140d873b4a8bde2cbfaa7e


    Headers

    Imports

    Sections