General
-
Target
c4ca804321608d2b5f6bc99902969f91_cobalt-strike_cobaltstrike_JC.exe
-
Size
208KB
-
Sample
230828-wrx9bsha71
-
MD5
c4ca804321608d2b5f6bc99902969f91
-
SHA1
647303fa86c91d812706ecaba7b80793c7984faa
-
SHA256
427e057ff2831e74919e7079efcd4a5ac47e05e6085e0a09e33292b3b3845e5d
-
SHA512
f6d2335caad4005334664acd9b714deefc261601999f88d1f73cda62f69498c05fc3d3556989563a90d47957884cbe54d44da1a1a35dae175e7575fa7fe2c810
-
SSDEEP
3072:cI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdU0fE7Y5m:cIDff9D8C6XYRw6MT2DEjbs
Behavioral task
behavioral1
Sample
c4ca804321608d2b5f6bc99902969f91_cobalt-strike_cobaltstrike_JC.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
c4ca804321608d2b5f6bc99902969f91_cobalt-strike_cobaltstrike_JC.dll
Resource
win10v2004-20230703-en
Malware Config
Extracted
cobaltstrike
100000
http://207.244.234.206:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
2048
-
host
207.244.234.206,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAABAAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAAGnNraW49bm9za2luO3Nlc3Npb24tdG9rZW49AAAAAQAAAC07Y3NtLWhpdD1zLTI0S1UxMUJCODJSWlNZR0ozQkRLfDE0MTk4OTkwMTI5OTYAAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAQAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAAA5vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
7680
-
polling_time
10000
-
port_number
443
-
sc_process32
C:\Windows\SysWOW64\dllhost.exe
-
sc_process64
C:\Windows\System32\dllhost.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCobS7V/2oSSOu3X66eSskC07B1tmzJgmekNfMsp/ud4Fcej06gUyCzwVzwL8D0hnBN84MyCDqXEhJxZoINNyz3qLzT7f/nzUQ51lqIGaFlfJS0/hqB1HGRVHUUsFe2pZRUpZ2UNPRYnY3AKIlYU3DmZB/M2phJpN+in/W/R4OZ8QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
2.68439552e+08
-
unknown2
AAAABAAAAA8AAAACAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/6.0 (Windows 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/99.0
-
watermark
100000
Targets
-
-
Target
c4ca804321608d2b5f6bc99902969f91_cobalt-strike_cobaltstrike_JC.exe
-
Size
208KB
-
MD5
c4ca804321608d2b5f6bc99902969f91
-
SHA1
647303fa86c91d812706ecaba7b80793c7984faa
-
SHA256
427e057ff2831e74919e7079efcd4a5ac47e05e6085e0a09e33292b3b3845e5d
-
SHA512
f6d2335caad4005334664acd9b714deefc261601999f88d1f73cda62f69498c05fc3d3556989563a90d47957884cbe54d44da1a1a35dae175e7575fa7fe2c810
-
SSDEEP
3072:cI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdU0fE7Y5m:cIDff9D8C6XYRw6MT2DEjbs
Score3/10 -