cobaltstrike

Sharing

Copy URL

Twitter E-mail

General

Target

794c7af6a850461230d5df6e2de755c9ce8489b9d46a4723eb313a56e2aadebd
Size

735KB
Sample

231225-tgtr2sdhd7
MD5

013a376bdb7d69af643169331ed12506
SHA1

acb53a6bf5e2542382230b7e90471ee95e91a194
SHA256

794c7af6a850461230d5df6e2de755c9ce8489b9d46a4723eb313a56e2aadebd
SHA512

46ebe9608b251cf11bae63b47f7bdf7d2346d8d3d50aed7559435c5a5b6e9cbcaac548cb9d68ef9015b1e28e43a189be202d9465c7997a7bb25245f9e5905124
SSDEEP

12288:H5Gok9IttZBlP1fs4escXHZD+5UnIGQ/pyYSTWnRcpR6q/qkN8xbV8bNVV93T:oo+CBLETscJfQjST9R1NMiDbj

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000

http://222.186.131.95:39443/api/auth/v1/log

Attributes

access_type
512
beacon_type
2048
host
222.186.131.95,/api/auth/v1/log
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAcAAAAAAAAAAwAAAAIAAAAKU0VTU0lPTklEPQAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAARQ29ubmVjdGlvbjogY2xvc2UAAAAKAAAAJUFjY2VwdC1MYW5ndWFnZTogZW4tR0I7cT0wLjksICo7cT0wLjcAAAAKAAAAGENvbnRlbnQtVHlwZTogdGV4dC9wbGFpbgAAAAcAAAAAAAAAAwAAAAIAAAAJSlNFU1NJT049AAAABgAAAAZDb29raWUAAAAHAAAAAQAAAAMAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
9984
polling_time
18016
port_number
39443
sc_process32
%windir%\syswow64\runonce.exe
sc_process64
%windir%\sysnative\runonce.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCk8TDQPDxrtDGQd+EZF7en9yNcmEcpX9f9OG5xoAdUEd50W7ip+X1tDdewzxxRp3HdfrK0OxB9cI7NBCKXHDdV+bT6cvTx7EJ0LylxrbclEAMSV6IiSGP9x8bq5ydLNO+IuyT/APMdnUhZYRB9OQ7iwt09O+atIh1E+R/cPkSwTwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
1.481970944e+09
unknown2
AAAABAAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/api/baidu/auth
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36
watermark
100000

Targets

- Target
  
  ƽ&ַʥ100Ԫĵ/˵/.res/ProcComm.dll
- Size
  
  1.1MB
- MD5
  
  b2a1a796fb8a33b051ae560d30b74e8e
- SHA1
  
  b06f169055605ff9faec3545e36eeccfa22da42a
- SHA256
  
  05176ca81fdcc507b4fb1de01f56234a5370a730e2c2187bf3e6da3df9a9ac29
- SHA512
  
  b77ed9cc349e6e417ba6c55828f9a595972d5f9014a0d349e4e3e43453b378f5c239eeb3b4e8ebf0090c2b79f5632a604280c41d707a773a4fb9e3f17cff5269
- SSDEEP
  
  24576:cMaCIDDHcXbZ+chP+Rur0Driyhpuec/iSXhAfqowx:daCGHYd2Duy1
Score

1^/10
behavioral1 behavioral2
- Target
  
  ƽ&ַʥ100Ԫĵ/˵/.res/wps.scr
- Size
  
  779KB
- MD5
  
  d8fc52d9042e6bf1cbd7611976c0a534
- SHA1
  
  14243ddd2b76aa05e800304f2d3b65d9fcbb382e
- SHA256
  
  9bdac7b0a22a59a5fbab3460c2b05503e248b4a3517b542724d672906861c410
- SHA512
  
  e15e2944261020fdb47298eb945c1eb935ec116eac67d2326bdf0f2a8ad99a5c681ad050e6a960503789b8272bab8426f2c800a9b95a352a2924c9afd8cd9e3c
- SSDEEP
  
  12288:A5y7EG88YqzELNGqN27LcsHdYkM2ypXUh97rVDoNpCQW37dwS7ndg:gyIoYq17LcYdYkSK97rp2p3W3Ha
Score

10^/10

cobaltstrike 100000 backdoor trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
behavioral3 behavioral4
- Target
  
  ƽ&ַʥ100Ԫĵ/˵/ƽ&ַʥ100Ԫĵ.docx
- Size
  
  13KB
- MD5
  
  16c7a63012aa4d77f31fc77bfd734d80
- SHA1
  
  4cf5373dea58bcaeb4b502cec3a2e5c76bb4b52f
- SHA256
  
  e364e89c4c9f50d4782cba50dd27b724eff554b0c6a670861fda98af2f6833c3
- SHA512
  
  ca97265dc843a939676e5282f67a8ded9f2d8dab116767fd0c88777a69e7a2297eaae83eaec67e12da471769a5df4234ea79a72fdb607b883799307215fe4cdd
- SSDEEP
  
  384:acTShuj8v55nl4vvjk1NFcQrlSNgvhtS4Z:lTS8jinl4vYqssNgveI
Score

4^/10
behavioral5 behavioral6
- Target
  
  ƽ&ַʥ100Ԫĵ/ƽ&ַʥ100Ԫĵ.docx.lnk
- Size
  
  748B
- MD5
  
  b0d9f8723696d2ce17fb4ba525b4888e
- SHA1
  
  8b8d5ec3f43a0114c710b81ceb393490a436767b
- SHA256
  
  da7fcce66cf6716483888efa1f8f25acf2a65a7ccdb2b1cbb57f8e952b79bf01
- SHA512
  
  31a573a37afa693a9f18d43360f3bf6192476f94512dc8ef4d6b69a794f6a07985aa93ffb90f478a9f250f929242add4cbd7879f2d4bc441593aedb52b13c14f
Score

1^/10
behavioral7 behavioral8

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8