cobaltstrike | a1808a588e5112ca17a0244be114e444fc333b5eb71f80feedc5f3e033f77591 | Triage

Sharing

General

Target

a1808a588e5112ca17a0244be114e444fc333b5eb71f80feedc5f3e033f77591
Size

259KB
Sample

231011-xv5y1shf23
MD5

cd8dde7aa1542965be2afa25806ee4f9
SHA1

6695837ed7e2343880962be1c07c5ff714895a3d
SHA256

a1808a588e5112ca17a0244be114e444fc333b5eb71f80feedc5f3e033f77591
SHA512

e2a0eb639403d7982f9c5048b5c76ffcff94bdd9e338cb148e31d2fa02f5655ce9b0b3175fe24933b27f0e36db75c51d6ecb015427f75db4340242993a0573bc
SSDEEP

3072:YEX+XSzARN6v+Xkce1Z53/gp0rbJ21TjPThZb2fQgEz6i0CcV9CYJYiK+82x:YEX5ye1bIp0rbaTSI5z6i0FCX+

Score

10^/10

cobaltstrike 100000

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000

C2

http://dns.dddumpling.xyz:53/cx

Attributes

access_type
512
beacon_type
256
host
dns.dddumpling.xyz,/cx
http_method1
GET
http_method2
POST
maxdns
255
polling_time
60000
port_number
53
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCh70BlD6Tt5SLsqlLB4SOVblXCOkmUHz7sjazg9EdPKaGvKw8SbffZfGijQRMpErRkqVca3JaaBDzDDwIQL6irMaFjjgClTWOASuAbaDR8p2pI1ck29uVrX0qDQa2uEaAhWX1zsUODyekxkm/C4BEw5wcbk+Y1hWJ5FVCoxC4p4QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
watermark
100000

Targets

- Target
  
  a1808a588e5112ca17a0244be114e444fc333b5eb71f80feedc5f3e033f77591
- Size
  
  259KB
- MD5
  
  cd8dde7aa1542965be2afa25806ee4f9
- SHA1
  
  6695837ed7e2343880962be1c07c5ff714895a3d
- SHA256
  
  a1808a588e5112ca17a0244be114e444fc333b5eb71f80feedc5f3e033f77591
- SHA512
  
  e2a0eb639403d7982f9c5048b5c76ffcff94bdd9e338cb148e31d2fa02f5655ce9b0b3175fe24933b27f0e36db75c51d6ecb015427f75db4340242993a0573bc
- SSDEEP
  
  3072:YEX+XSzARN6v+Xkce1Z53/gp0rbJ21TjPThZb2fQgEz6i0CcV9CYJYiK+82x:YEX5ye1bIp0rbaTSI5z6i0FCX+
Score

1^/10
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

100000cobaltstrike

behavioral1

behavioral2