General
-
Target
2023-08-26_29351f1e6a63bd430094ce1156a72c03_cobalt-strike_cobaltstrike_JC.exe
-
Size
208KB
-
Sample
231012-camlqabb35
-
MD5
29351f1e6a63bd430094ce1156a72c03
-
SHA1
fc5aac3031eb9169b903059e347fa58e7c976183
-
SHA256
2521c36107a687d21bc17d6603ef51de9daa4e212c3d749b57683ba804e3534d
-
SHA512
d2fea0afb7a2df96b6d7eaf0e6cfe9e0e589b628277ee8a908159c0c330277fee9ebec8f7c0c96932ceb08468276697ff40b5cee3183702000838d75fc6c9331
-
SSDEEP
3072:z+FcIvEbJvYdGVWwk4Kj6olpR2B5f4dS/L4jjZUWk5Iw6E:AHEbJAZwBqplpAX/Lmj3jbE
Behavioral task
behavioral1
Sample
2023-08-26_29351f1e6a63bd430094ce1156a72c03_cobalt-strike_cobaltstrike_JC.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-26_29351f1e6a63bd430094ce1156a72c03_cobalt-strike_cobaltstrike_JC.dll
Resource
win10v2004-20230915-en
Malware Config
Extracted
cobaltstrike
1873433027
http://8.130.32.145:50051/ptj
-
access_type
512
-
host
8.130.32.145,/ptj
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
polling_time
60000
-
port_number
50051
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCAX9flCDlYHcsS1bBMEX5zMYMgsKxIxUiwHSgJ1TP2wj67YSRTmTQ+SkVxQ7txq1uZIfMGb/zbYoBImj9SzIDWzAH6tri4qu8otHep1aHlae/HgIkuIUbKWomvS+WK8ZUG1x1Iph7H3VPzPpa+7gfMUlJkYaXHGwyBNkw6KO6m6wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; MANM)
-
watermark
1873433027
Targets
-
-
Target
2023-08-26_29351f1e6a63bd430094ce1156a72c03_cobalt-strike_cobaltstrike_JC.exe
-
Size
208KB
-
MD5
29351f1e6a63bd430094ce1156a72c03
-
SHA1
fc5aac3031eb9169b903059e347fa58e7c976183
-
SHA256
2521c36107a687d21bc17d6603ef51de9daa4e212c3d749b57683ba804e3534d
-
SHA512
d2fea0afb7a2df96b6d7eaf0e6cfe9e0e589b628277ee8a908159c0c330277fee9ebec8f7c0c96932ceb08468276697ff40b5cee3183702000838d75fc6c9331
-
SSDEEP
3072:z+FcIvEbJvYdGVWwk4Kj6olpR2B5f4dS/L4jjZUWk5Iw6E:AHEbJAZwBqplpAX/Lmj3jbE
Score3/10 -