Overview

overview

10

Static

static

10

ccd5640db1...2f.dll

windows7-x64

1

ccd5640db1...2f.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    ccd5640db11cb3e4319351f40b105c4c9f669f0057260886431079e324e2ee2f.bin

  • Size

    218KB

  • MD5

    228e4d6d05ceaa05e8c4ff8cff0a60f3

  • SHA1

    3d4e5ae32ff4b998b3d9da784332ebfddddcae32

  • SHA256

    ccd5640db11cb3e4319351f40b105c4c9f669f0057260886431079e324e2ee2f

  • SHA512

    ea721641e113e99a4bcab20226c53a465974f8ba7170eadaf51a67dfae02a3eb826a37c0c68d3edcac3ba7931b926d135c4b82ee7f91f78af6f50c1ad24b351a

  • SSDEEP

    6144:P66JU8IxXC3YSL2a1Wd7h00Lks1YarGR8rjXuqpjkA:iUf0XyYmYvbLks1YarGR8OWjx

Score
10/10
380330973cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

380330973

C2

http://d30a2o6zg7ra9b.cloudfront.net:443/cs.html

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    d30a2o6zg7ra9b.cloudfront.net,/cs.html

  • http_header1

    AAAAEAAAABlIb3N0OiBzZWN1cml0aWVzLXJhdGUuY29tAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAALQWNjZXB0OiAqLyoAAAAHAAAAAAAAAAMAAAADAAAAAgAAAAVMU0lEPQAAAAYAAAAGQ29va2llAAAACQAAAAxleGNsdWRlPXRydWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAAEAAAABlIb3N0OiBzZWN1cml0aWVzLXJhdGUuY29tAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAA9QWNjZXB0LUxhbmd1YWdlOiBmci1DSCwgZnI7cT0wLjksIGVuO3E9MC44LCBkZTtxPTAuNywgKjtxPTAuNQAAAAoAAAAYQ29udGVudC1UeXBlOiB0ZXh0L3BsYWluAAAABwAAAAEAAAAPAAAAAwAAAAQAAAAHAAAAAAAAAAMAAAACAAAADl9fc2Vzc2lvbl9faWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    9984

  • polling_time

    62907

  • port_number

    443

  • sc_process32

    %windir%\syswow64\WUAUCLT.exe

  • sc_process64

    %windir%\sysnative\WUAUCLT.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDB2qHXReBIJOKgeBURVPVr00hBU6JHNCQRIFSKDby6drDAAwV/r2Rrm1ZOS8OUGL55DiNT8nlzuS3441ItXk+Bx5rYYTfU5NF0LHbS8Rv6rQLJDnFH6uduFxVR0IJnZFLnLiRhLC8T5iOjvO6+Jh214FTI5842FmZnmRLNS4FhMQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4.272630272e+09

  • unknown2

    AAAABAAAAAIAAAFSAAAAAwAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /panel

  • user_agent

    Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202

  • watermark

    380330973

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • ccd5640db11cb3e4319351f40b105c4c9f669f0057260886431079e324e2ee2f.bin
    .dll windows:5 windows x86 arch:x86

    2784a31e81408c6a1b0043d146be54b5


    Headers

    Imports

    Exports

    Sections