cobaltstrike | 676b65c528d67f76fb347482f98cfc97e1b39cc56d6538ab5cb96eb7a3a97658[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
676b65c528d67f76fb347482f98cfc97e1b39cc56d6538ab5cb96eb7a3a97658.zip
Size 127KB
Sample240720-3mwchasekn
SHA256 edf7f52b1e3c75ed57127f9c362c2c38a35eba2a69e1a5ae16a6f6c2f63678ab
MD5 e4c15ac34d72869688c2fedcf2ad9ee4
SHA1 4046109a4573c38209c9079a0a8e47c149c912de
SHA512 7c9c453cfa2c4fb3a7dbe2bf8d58b6fef6903cb03c6364ed2506f070c4c8bd0f006f162645ca36dbac7db09df24e37e2c71ad5729f39753be718e360e7e36952
SSDEEP 3072:7/KU411D8G610MsH1iaIM5tCY2dt91mBDdP:ZU1Df6LsHvtP2L05
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

0 cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://103.27.110.192:53/en_US/all.js

Attributes

access_type
512
host
103.27.110.192,/en_US/all.js
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
53
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCnOM3nXx+7HBhkbDd+AwFrFisSunK999w2tM0uTpuuEiBalcJhcL+QgQWtf6S7zPp5hjImG+2YcPl18geU4f5JlSPXHwilbK4DFb/ePWyKFjhrA7emVRqhM21QMlo1ANsn14rY/RO2pzuft8P7TXoIjjI/B2GGVuzYNZX6X4I2EwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; FunWebProducts)
watermark
0

Signatures

Cobaltstrike family
cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/676b65c528d67f76fb347482f98cfc97e1b39cc56d6538ab5cb96eb7a3a97658

File Explorer

676b65c528d67f76fb347482f98cfc97e1b39cc56d6538ab5cb96eb7a3a97658.zip

.zip 127KB
676b65c528d67f76fb347482f98cfc97e1b39cc56d6538ab5cb96eb7a3a97658

.dll 260KB

676b65c528d67f76fb347482f98cfc97e1b39cc56d6538ab5cb96eb7a3a97658.zip

SHA256 edf7f52b1e3c75ed57127f9c362c2c38a35eba2a69e1a5ae16a6f6c2f63678ab
MD5 e4c15ac34d72869688c2fedcf2ad9ee4
SHA1 4046109a4573c38209c9079a0a8e47c149c912de
SHA512 7c9c453cfa2c4fb3a7dbe2bf8d58b6fef6903cb03c6364ed2506f070c4c8bd0f006f162645ca36dbac7db09df24e37e2c71ad5729f39753be718e360e7e36952
SSDEEP 3072:7/KU411D8G610MsH1iaIM5tCY2dt91mBDdP:ZU1Df6LsHvtP2L05
MD5 SHA1 SHA512 SSDEEP

Password

infected

676b65c528d67f76fb347482f98cfc97e1b39cc56d6538ab5cb96eb7a3a97658

IMPHASH aa81c1b260a0efe3cd2c26c7046b78ed
SHA256 676b65c528d67f76fb347482f98cfc97e1b39cc56d6538ab5cb96eb7a3a97658
MD5 dd01b8d674447152fece45e1874a0371
SHA1 a83bc359c6e50135c6db338d6f987c61718e2ddf
SHA512 22c7cf72a64f12bb137145fba6f975eca49cbc73ce77b15cac20b60ad304b794b4e1a24d31cad8b085c225cc1459bca7bf0c834db05dd88b2f08fd6812940f63
SSDEEP 3072:7c0nsHpyvGj346lbkBN/gppj8aJGIhxjT3A8ygbLAZmitdGlX9tQYJ1b/S1Pry8C:7c0bPzIpt8ahTw8PHA8itQpQv2uE
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

115404

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

VirtualProtectEx TerminateProcess ReadProcessMemory WriteProcessMemory GetThreadContext ResumeThread CreateProcessA GetCurrentDirectoryW GetFullPathNameA GetLogicalDrives FindClose SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExpandEnvironmentStringsA GetFileAttributesA FindFirstFileA FindNextFileA CopyFileA MoveFileA VirtualProtect OpenProcess GetCurrentProcessId VirtualAllocEx CreateThread OpenThread CreateToolhelp32Snapshot Thread32First Thread32Next CreateRemoteThread SetThreadContext MapViewOfFile UnmapViewOfFile CreateFileMappingA Wow64GetThreadContext Wow64SetThreadContext SetLastError SetNamedPipeHandleState PeekNamedPipe CreateFileA WaitNamedPipeA GetModuleFileNameA GetComputerNameA GetVersionExA GetACP GetOEMCP HeapAlloc CreateNamedPipeA GetProcessHeap InitializeProcThreadAttributeList DeleteProcThreadAttributeList SetErrorMode UpdateProcThreadAttribute DuplicateHandle ProcessIdToSessionId Process32First Process32Next VirtualQuery ExitProcess ExitThread ConnectNamedPipe ReadFile GetCurrentThread GetCurrentProcess MultiByteToWideChar GetCurrentDirectoryA SetCurrentDirectoryA GetStartupInfoA DisconnectNamedPipe CreatePipe GetTickCount GetLocalTime CloseHandle FlushFileBuffers WriteFile WaitForSingleObject GetLastError Sleep GetModuleHandleA RaiseException SetEnvironmentVariableW SetEnvironmentVariableA LoadLibraryA VirtualFree VirtualAlloc SetEndOfFile CreateFileW WriteConsoleW SetStdHandle GetStringTypeW LCMapStringW CompareStringW HeapReAlloc HeapSize LoadLibraryW OutputDebugStringW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter RemoveDirectoryW CreateDirectoryW DeleteFileW GetFileType SetFilePointerEx SetFilePointer ReadConsoleW GetConsoleMode GetConsoleCP GetProcAddress HeapFree FreeLibrary EncodePointer DecodePointer GetModuleHandleExW AreFileApisANSI GetSystemTimeAsFileTime GetCommandLineA GetCurrentThreadId GetStdHandle GetModuleFileNameW IsDebuggerPresent IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection RtlUnwindEx InitializeCriticalSectionAndSpinCount DeleteCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW LoadLibraryExW IsValidCodePage GetCPInfo WideCharToMultiByte

advapi32

GetTokenInformation OpenProcessToken CryptReleaseContext CryptAcquireContextA CryptGenRandom CheckTokenMembership DuplicateTokenEx LogonUserA LookupAccountSidA FreeSid AllocateAndInitializeSid ImpersonateNamedPipeClient RevertToSelf GetUserNameA CreateProcessWithTokenW CreateProcessWithLogonW CreateProcessAsUserA ImpersonateLoggedOnUser LookupPrivilegeValueA AdjustTokenPrivileges OpenThreadToken

wininet

InternetConnectA InternetCloseHandle InternetReadFile InternetQueryDataAvailable InternetQueryOptionA InternetSetOptionA InternetSetStatusCallback HttpOpenRequestA HttpAddRequestHeadersA HttpSendRequestA HttpQueryInfoA InternetOpenA

ws2_32

connect closesocket WSACleanup send gethostname gethostbyname ntohl htons htonl socket ntohs ioctlsocket recv shutdown WSAGetLastError __WSAFDIsSet accept bind listen select WSAStartup