cobaltstrike

General

Target
e09f421f7d1f8601382ba06f8.exe
Size 2.4MB
Sample230823-m5dx6sda8s
SHA256 e09f421f7d1f8601382ba06f854360dce742321bb0d9b1433374cd1dc7cc4490
MD5 76172b8704c46cfb5565920279e6f41b
SHA1 ac3441c0f0e89e64a71c107fbb8ba98994d63b45
SHA512 ffdd7f195f1b1514a552ad9f718c5b30adbea9341833247924e287ccb71c3c03f652c5b8c52d7c7acdf5fd1172b106716031363b72677e40862893b244c62385
SSDEEP 49152:2Ry8Fji0FXP4Op3BsiBAi/z95pQJuGi+7dxxcR0h8Pbc+xXXGFbSLWHHOXl:J23BsgL4HOXl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000

C2

http://114.132.186.147:80/introduction/edr

Attributes

access_type
512
host
114.132.186.147,/introduction/edr
http_header1
AAAACgAAAB5BY2NlcHQtRW5jb2Rpbmc6IGd6aXAsIGRlZmxhdGUAAAAKAAAADFRlOiB0cmFpbGVycwAAAAoAAAALQWNjZXB0OiAqLyoAAAAHAAAAAAAAAA0AAAACAAAABUFOSUQ9AAAAAgAAABlfX1NlY3VyZS0zUEFQSVNJRD1ub3NraW47AAAAAQAAACM7Q09OU0VOVD1ZRVMrQ04uemgtQ04rMjAyMTA5MTctMDktMAAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IHRleHQvcGxhaW47Y2hhcnNldD1VVEYtOAAAAAoAAAAkUmVmZXJlcjogaHR0cHM6Ly9lZHIuc2FuZ2Zvci5jb20uY24vAAAACgAAAAxUZTogdHJhaWxlcnMAAAAKAAAAIk9yaWdpbjogaHR0cHM6Ly9lZHIuc2FuZ2Zvci5jb20uY24AAAAHAAAAAAAAAA0AAAAFAAAACF9fZm9ybWlkAAAACQAAABNzcmNodWlkPWtzSFZ0cGdoYUtRAAAACQAAABFzZWFyY2hrZXk9RGZNaVZBbAAAAAcAAAABAAAADQAAAAIAAAAqYWlkXz01MjIwMDU3MDUmYWNjdmVyPTEmc2hvd3R5cGU9ZW1iZWQmdWE9AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
5120
polling_time
12000
port_number
80
sc_process32
%windir%\syswow64\dllhost.exe
sc_process64
%windir%\sysnative\dllhost.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCJCYc9eAq47DNO6xFtarPfT8b9EHw2wZWKK0UKO0U0/0OKxEboQuNLnz9d4XdCuGHdmksxihUfu5zoFUa36irp/vEuqglGiCIcXnKWJUO3pVCjzWGAXk9UiZmCw8HDL++x5LpKz08rhcuOig3uFRyrM7++VrlhWaqxPN3FluYfwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
3.103793152e+09
unknown2
AAAABAAAAAEAAAA/AAAAAgAAAD0AAAACAAAAPQAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/api/artical/tag
user_agent
Mozilla/5.0 (iPad; CPU iPad OS 10_3_4 like Mac OS X) AppleWebKit/532.1 (KHTML, like Gecko) CriOS/30.0.834.0 Mobile/77D555 Safari/532.1
watermark
100000

Targets

- Target
  e09f421f7d1f8601382ba06f8.exe
- Size 2.4MB
- SHA256 e09f421f7d1f8601382ba06f854360dce742321bb0d9b1433374cd1dc7cc4490
- MD5 76172b8704c46cfb5565920279e6f41b
- SHA1 ac3441c0f0e89e64a71c107fbb8ba98994d63b45
- SHA512 ffdd7f195f1b1514a552ad9f718c5b30adbea9341833247924e287ccb71c3c03f652c5b8c52d7c7acdf5fd1172b106716031363b72677e40862893b244c62385
- SSDEEP 49152:2Ry8Fji0FXP4Op3BsiBAi/z95pQJuGi+7dxxcR0h8Pbc+xXXGFbSLWHHOXl:J23BsgL4HOXl
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

cobaltstrike 100000 backdoor trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

Score

3^/10

behavioral1

cobaltstrike100000backdoortrojan

Score

10^/10

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Matrix

Tasks

static1

behavioral1