cobaltstrike

General

Target

all.ps1
Size

226KB
Sample

240222-z3dwlsfb9t
MD5

2ff7e2095db12b529ddadeac322b24e1
SHA1

c3268da74b314bb7c8d409e9a20de59743d08072
SHA256

1541b647ed27bf303b484186f9c7eeea232129f3dfa1588a594fefec0eff383a
SHA512

720fd709595be6e8646ebfc4684c3a482a89ce1c3ad50d0282486b32998b5bf9e26b19ae71fb0193c3806f551d69776055cad3b6f9057937c3fb87aa545bb9a8
SSDEEP

6144:v/n5fJKv7L6SzT9qQqtZg6VkOhTRWXtoIVX+e:vf5fJKDOJVhNPIZ+e

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

674054486

C2

http://91.238.181.238:1443/Validate/v10.6/W2GE3SC8

Attributes

access_type
512
beacon_type
2048
host
91.238.181.238,/Validate/v10.6/W2GE3SC8
http_header1
AAAACgAAADpBY2NlcHQ6IGFwcGxpY2F0aW9uL2pzb24sIHRleHQvaHRtbCwgYXBwbGljYXRpb24veGh0bWwreG1sAAAACgAAABNBY2NlcHQtTGFuZ3VhZ2U6IHhoAAAACgAAAB9BY2NlcHQtRW5jb2Rpbmc6IGNvbXByZXNzLCBnemlwAAAABwAAAAAAAAAPAAAADQAAAAIAAAAVc2VjdXJlX2lkX05DU1E0WkhPNVM9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAADJBY2NlcHQ6IGFwcGxpY2F0aW9uL3htbCwgYXBwbGljYXRpb24vanNvbiwgaW1hZ2UvKgAAAAoAAAAWQWNjZXB0LUxhbmd1YWdlOiBhci1lZwAAAAoAAAAZQWNjZXB0LUVuY29kaW5nOiBnemlwLCBicgAAAAcAAAAAAAAADwAAAAsAAAAFAAAACV9BQ1VHQURGRgAAAAcAAAABAAAADwAAAA0AAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
10752
polling_time
93951
port_number
1443
sc_process32
%windir%\syswow64\systray.exe
sc_process64
%windir%\sysnative\DevicePairingWizard.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDU59ubetiY+LhOdd2F8C7vXLkVybNh6QaoPJk+VKmF/XO4EC9ac/zQUTWxzea8pBym/dgVAYJe1lZYQxBtHWkfCagWuxXxmc2GtqePiIkf5ObAy1rgRfumNilh3iA+t5X758wXqhLDQXRfTIFzzM5dVF4RwKydstaCNmbL/+C+FwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
2.602442752e+09
unknown2
AAAABAAAAAEAAAscAAAAAgAAE3cAAAAIAAAADwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/Study/names/85S6BPFEU7F
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.101 Safari/537.36
watermark
674054486
year
512

Targets

- Target
  
  all.ps1
- Size
  
  226KB
- MD5
  
  2ff7e2095db12b529ddadeac322b24e1
- SHA1
  
  c3268da74b314bb7c8d409e9a20de59743d08072
- SHA256
  
  1541b647ed27bf303b484186f9c7eeea232129f3dfa1588a594fefec0eff383a
- SHA512
  
  720fd709595be6e8646ebfc4684c3a482a89ce1c3ad50d0282486b32998b5bf9e26b19ae71fb0193c3806f551d69776055cad3b6f9057937c3fb87aa545bb9a8
- SSDEEP
  
  6144:v/n5fJKv7L6SzT9qQqtZg6VkOhTRWXtoIVX+e:vf5fJKDOJVhNPIZ+e
Score

10^/10

cobaltstrike 674054486 backdoor trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Blocklisted process makes network request
behavioral1