Overview

overview

10

Static

static

10

525d715251...27.dll

windows7-x64

1

525d715251...27.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    525d715251c970eda2e48367e0d01b0de1b99238eed05ca68fccc257d067ba27

  • Size

    259KB

  • Sample

    231012-bq6tvshf25

  • MD5

    b8cadecf6a79b6914b173bab543f051a

  • SHA1

    43a323248fe3d58e88f87dc535b695c3d2b081a8

  • SHA256

    525d715251c970eda2e48367e0d01b0de1b99238eed05ca68fccc257d067ba27

  • SHA512

    d0a0fda7a23acd51edd93db1fc186a3690593b68671d3d7ab5bf12346fce527cd21d521f4480d9bad8f488b0386f6d0b371a376eda8f1c45fcba62f05c8e5e13

  • SSDEEP

    6144:uJqVG5d1IpMyibgkTZI6jHID90adBX3H/:u3d6tevoxtBXP

Score
10/10
cobaltstrike666666

Malware Config

Extracted

Family

cobaltstrike

Botnet

666666

C2

http://107.172.216.18:8082/push

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    107.172.216.18,/push

  • http_header1

    AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • polling_time

    60000

  • port_number

    8082

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCMPrAOjBkEiTrxFoj8HLOracoEcQEDg0yzjMl4hFrabyhY2eqIEaQ2KwzIWg0MgYd7kWKmDfmlBj56Fe/UUZb62IHRKi1KJ3eS+qJa5w5KhVVheIiX38oL3L1k1Euzt5+CkwM6lCyc40BM5G8mlF2IvQinil5VL+UHCQCebjvvowIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit.php

  • user_agent

    Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0)

  • watermark

    666666

Targets

    • Target

      525d715251c970eda2e48367e0d01b0de1b99238eed05ca68fccc257d067ba27

    • Size

      259KB

    • MD5

      b8cadecf6a79b6914b173bab543f051a

    • SHA1

      43a323248fe3d58e88f87dc535b695c3d2b081a8

    • SHA256

      525d715251c970eda2e48367e0d01b0de1b99238eed05ca68fccc257d067ba27

    • SHA512

      d0a0fda7a23acd51edd93db1fc186a3690593b68671d3d7ab5bf12346fce527cd21d521f4480d9bad8f488b0386f6d0b371a376eda8f1c45fcba62f05c8e5e13

    • SSDEEP

      6144:uJqVG5d1IpMyibgkTZI6jHID90adBX3H/:u3d6tevoxtBXP

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks