cobaltstrike

General

Target

3b723bac9fe0b8578b2a9e2aa8ec33875eec3af464afc0f616c6a78cad128447
Size

3.5MB
Sample

230817-pfa64aah6s
MD5

2e72f69e74b1154172c73b66d8ebdb50
SHA1

a0a75ed3c359321bb72d784db990505d7abd4f2b
SHA256

3b723bac9fe0b8578b2a9e2aa8ec33875eec3af464afc0f616c6a78cad128447
SHA512

8ee2e176b48b79b34567111a04baf6150f3126ea96c5c891b77c2ff2b89952f9100a92851d99b5c33be1cefc229c5c51a8c4af49a813d84a163ccce8854cbfd5
SSDEEP

98304:2ObvM5xLPTw9p8vUCO1APBx2fBElBwtX5A+quvlp+pE2Ei/dBl:PbE5VbOpGUF1o2ZqSrDquP+pE2Ei1Bl

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000000

C2

http://global.cdn-global-jsdelivr.com:8443/jquery-3.3.1.min.js

Attributes

access_type
512
beacon_type
2048
host
global.cdn-global-jsdelivr.com,/jquery-3.3.1.min.js
http_header1
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAABAAAAAkSG9zdDogZ2xvYmFsLmNkbi1nbG9iYWwtanNkZWxpdnIuY29tAAAACgAAACBSZWZlcmVyOiBodHRwOi8vY29kZS5qcXVlcnkuY29tLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAACgAAACpDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uLyo7IGNoYXJzZXQ9dXRmLTgAAAAHAAAAAAAAAA8AAAANAAAAAgAAAAlfX2NmZHVpZD0AAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAABAAAAAkSG9zdDogZ2xvYmFsLmNkbi1nbG9iYWwtanNkZWxpdnIuY29tAAAACgAAACBSZWZlcmVyOiBodHRwOi8vY29kZS5qcXVlcnkuY29tLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAACgAAACpDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uLyo7IGNoYXJzZXQ9dXRmLTgAAAAHAAAAAAAAAAUAAAAIX19jZmR1aWQAAAAHAAAAAQAAAA8AAAANAAAAAgAAAAVkYXRhPQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
9472
polling_time
30000
port_number
8443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCvMdcsb9ZNBzCSIdQqhjJt097xwSG/2J0ZqIIk3h4FWPJagGpotX4GwUH9Qz6MEnrQYcNxBLWn65DmhKTpzu/QKGMwSgjdkpdaPB3INcQqzI+caB/czJCIygaRIlyHkQpLOS3y6XHoTZc3rHt4vDbjdrE+7qEpZYtPNQ3/nL2vxQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4.201256192e+09
unknown2
AAAABAAAAAEAAAXyAAAAAgAAAFQAAAACAAAPWQAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/jquery-3.3.2.min.js
user_agent
Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
watermark
100000000

Extracted

Family

cobaltstrike

Botnet

100000000

C2

http://global.cdn-global-jsdelivr.com:8443/jquery-3.3.1.min.js

Attributes

access_type
512
beacon_type
2048
host
global.cdn-global-jsdelivr.com,/jquery-3.3.1.min.js
http_header1
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAABAAAAAkSG9zdDogZ2xvYmFsLmNkbi1nbG9iYWwtanNkZWxpdnIuY29tAAAACgAAACBSZWZlcmVyOiBodHRwOi8vY29kZS5qcXVlcnkuY29tLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAACgAAACpDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uLyo7IGNoYXJzZXQ9dXRmLTgAAAAHAAAAAAAAAA8AAAANAAAAAgAAAAlfX2NmZHVpZD0AAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAABAAAAAkSG9zdDogZ2xvYmFsLmNkbi1nbG9iYWwtanNkZWxpdnIuY29tAAAACgAAACBSZWZlcmVyOiBodHRwOi8vY29kZS5qcXVlcnkuY29tLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAACgAAACpDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uLyo7IGNoYXJzZXQ9dXRmLTgAAAAHAAAAAAAAAAUAAAAIX19jZmR1aWQAAAAHAAAAAQAAAA8AAAANAAAAAgAAAAVkYXRhPQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
9472
polling_time
30000
port_number
8443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCvMdcsb9ZNBzCSIdQqhjJt097xwSG/2J0ZqIIk3h4FWPJagGpotX4GwUH9Qz6MEnrQYcNxBLWn65DmhKTpzu/QKGMwSgjdkpdaPB3INcQqzI+caB/czJCIygaRIlyHkQpLOS3y6XHoTZc3rHt4vDbjdrE+7qEpZYtPNQ3/nL2vxQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4.201256192e+09
unknown2
AAAABAAAAAEAAAXyAAAAAgAAAFQAAAACAAAPWQAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/jquery-3.3.2.min.js
user_agent
Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
watermark
100000000

Targets

- Target
  
  windows8月补丁合集/x32.exe
- Size
  
  4.2MB
- MD5
  
  8f356cb98a02ba03ceebab95d0e44df9
- SHA1
  
  a81f1b6ed5a70f3707a1e5cd780b826d173e00f4
- SHA256
  
  3c230d8c69136df1c4112370fa30ca0454016c97329998f29d35f674e8e34e7e
- SHA512
  
  bad47f0ed6d2cbff6314c48714f328f19dbe31f9c531e29818927c0fa9c26329f4da3df29383553c40e2f76bafe92fcd69ba37a8539cb1bfb4b3521973acbbd1
- SSDEEP
  
  49152:8NDcmCtwfat/n8mrb/T/vO90d7HjmAFd4A64nsfJhCzwaSgY212lOz1LpQtIV432:C3at/NpQtIV43KmjzF
Score

10^/10

cobaltstrike 100000000 backdoor trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
behavioral1 behavioral2
- Target
  
  windows8月补丁合集/x64.exe
- Size
  
  4.6MB
- MD5
  
  97f58a9858772ae5b3b20d334564dd1f
- SHA1
  
  63fa5388cd7fc088d7286e01fefb1bd996ad96aa
- SHA256
  
  099352b65033a33e52a2c75f581836dbc196d44f9fb20b3878db430dd8e02836
- SHA512
  
  32a20f84be1aeb2b529e8357e3c08889c8cb4e6e9b9e6222ea79cbd79cbae16bb37897b184fd3393372f044c9057ff25adde376ab6ae27ec48a46ce414836ac3
- SSDEEP
  
  49152:cdXfY8em2N7Scrb/TwvO90d7HjmAFd4A64nsfJrJiCXJaSgY212Lwz1kpQt3q5fT:Of2NPpQtSccfpuzF
Score

10^/10

cobaltstrike 100000000 backdoor trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
behavioral3 behavioral4

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Cobaltstrike

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4