cobaltstrike | 24c4459965fbbe4fd644e24c2a58a1a97613a7eac25c40e778249700fc48307e

Sharing

Copy URL Twitter E-mail

General

Target
24c4459965fbbe4fd644e24c2a58a1a97613a7eac25c40e778249700fc48307e
Size 130KB
Sample240725-qvblvathmg
SHA256 24c4459965fbbe4fd644e24c2a58a1a97613a7eac25c40e778249700fc48307e
MD5 9ee64e70e8133877b7a0ab7b662d932a
SHA1 c8c80e9c899cfda355e6368980f636f99d9f715b
SHA512 1bcdd96166f961f56ddb50d23059ed1bb3afb90a68e0ffb6407fb178375216765707a5fda0b4c6c747db93d289aea3e7ac12006d5fb79bbd150b2e8e476f45ad
SSDEEP 3072:QADOFIEDGJKtUkjc5NBANCvBXZlHAsW9ETFR8FUkwcdM0d/:cFItJKtfcPggBppR5R7kwZ0Z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

391144938 cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

391144938

http://8.147.234.137:5656/ptj

Attributes

access_type
512
host
8.147.234.137,/ptj
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
5656
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4C/zCqT5l763V1VsnAqc3Y8bEEDYbQs+MQYBMwxZtxvcT5v6t4p+DmPUlS9DU56kBseFYx+zmrwP0vp3ZOrbm3b/N+RAiVn6ksFz+Ht/kquQ6WqdlglYwQHSBxCBq9NPJvMZu8YHUwkMIKHkLfRN4PeX4HRDYe4jeC6Rr7VbY+wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MDDRJS)
watermark
391144938

Signatures

Cobaltstrike family
cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/f8d67a21e4ca276367cb9b311e7d717bf7ea487970c9c5a12d56a0fe3846081d

File Explorer

24c4459965fbbe4fd644e24c2a58a1a97613a7eac25c40e778249700fc48307e

.zip 130KB
f8d67a21e4ca276367cb9b311e7d717bf7ea487970c9c5a12d56a0fe3846081d

.dll 272KB

24c4459965fbbe4fd644e24c2a58a1a97613a7eac25c40e778249700fc48307e

SHA256 24c4459965fbbe4fd644e24c2a58a1a97613a7eac25c40e778249700fc48307e
MD5 9ee64e70e8133877b7a0ab7b662d932a
SHA1 c8c80e9c899cfda355e6368980f636f99d9f715b
SHA512 1bcdd96166f961f56ddb50d23059ed1bb3afb90a68e0ffb6407fb178375216765707a5fda0b4c6c747db93d289aea3e7ac12006d5fb79bbd150b2e8e476f45ad
SSDEEP 3072:QADOFIEDGJKtUkjc5NBANCvBXZlHAsW9ETFR8FUkwcdM0d/:cFItJKtfcPggBppR5R7kwZ0Z
MD5 SHA1 SHA512 SSDEEP

Password

infected

f8d67a21e4ca276367cb9b311e7d717bf7ea487970c9c5a12d56a0fe3846081d

IMPHASH 036fe63de7eb1468fd90eb5a61bcbdf8
SHA256 f8d67a21e4ca276367cb9b311e7d717bf7ea487970c9c5a12d56a0fe3846081d
MD5 5bb52025289ba5357199bbe87732ad10
SHA1 f10ce6223b8ef1f25370d05ce98b19308d11aae7
SHA512 3734a70665dba699c74f41f4f951aae9dc665dcae58e2e58f50025d13fd07445f4ae782f135a2c200481e2f8d73461490697a29bd58aaef83b09d07d56d880f1
SSDEEP 3072:rzbINhWl+CIbfqqEVxtfg8jtfDCJS4l9JTFyG+JteEzCnL7zHGIkfhUYJF6vzHkV:rzbUWootfDCvT4ZTXzCLuIk5UDerKM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

120896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetCurrentProcess GetCurrentThread ReadFile ConnectNamedPipe CreateNamedPipeA VirtualProtectEx TerminateProcess ReadProcessMemory WriteProcessMemory GetThreadContext ResumeThread CreateProcessA GetCurrentDirectoryW GetFullPathNameA GetLogicalDrives FindClose SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExpandEnvironmentStringsA GetFileAttributesA FindFirstFileA FindNextFileA CopyFileA MoveFileA OpenProcess GetCurrentProcessId VirtualAllocEx CreateThread OpenThread CreateToolhelp32Snapshot Thread32First Thread32Next CreateRemoteThread SetThreadContext Wow64GetThreadContext Wow64SetThreadContext SetLastError SetNamedPipeHandleState PeekNamedPipe CreateFileA WaitNamedPipeA GetModuleFileNameA GetComputerNameA GetVersionExA GetACP GetOEMCP GetStartupInfoA InitializeProcThreadAttributeList DeleteProcThreadAttributeList SetErrorMode UpdateProcThreadAttribute DuplicateHandle ProcessIdToSessionId Process32First Process32Next VirtualQuery ExitProcess ExitThread DisconnectNamedPipe CreatePipe GetTickCount GetLocalTime FlushFileBuffers WriteFile WaitForSingleObject Sleep GetModuleHandleA LoadLibraryA CreateFileMappingA UnmapViewOfFile MapViewOfFile CloseHandle GetLastError HeapFree HeapAlloc HeapDestroy HeapCreate RaiseException SetEnvironmentVariableW SetEnvironmentVariableA VirtualProtect VirtualFree VirtualAlloc SetEndOfFile CreateFileW WriteConsoleW SetStdHandle GetStringTypeW LCMapStringW CompareStringW HeapSize LoadLibraryW OutputDebugStringW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter RemoveDirectoryW CreateDirectoryW DeleteFileW GetFileType SetFilePointerEx SetFilePointer ReadConsoleW GetConsoleMode GetConsoleCP WideCharToMultiByte GetCPInfo IsValidCodePage RtlUnwindEx GetProcAddress GetProcessHeap FreeLibrary EncodePointer DecodePointer GetModuleHandleExW AreFileApisANSI GetSystemTimeAsFileTime HeapReAlloc GetCommandLineA GetCurrentThreadId GetStdHandle GetModuleFileNameW IsDebuggerPresent IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW LoadLibraryExW

advapi32

GetTokenInformation OpenProcessToken CryptReleaseContext CryptAcquireContextA CryptGenRandom CheckTokenMembership DuplicateTokenEx LogonUserA LookupAccountSidA FreeSid AllocateAndInitializeSid ImpersonateNamedPipeClient RevertToSelf GetUserNameA CreateProcessWithTokenW CreateProcessWithLogonW CreateProcessAsUserA ImpersonateLoggedOnUser LookupPrivilegeValueA AdjustTokenPrivileges OpenThreadToken

wininet

InternetReadFile InternetCloseHandle InternetConnectA InternetQueryDataAvailable InternetQueryOptionA InternetSetOptionA InternetSetStatusCallback HttpOpenRequestA HttpAddRequestHeadersA HttpSendRequestA HttpQueryInfoA InternetOpenA

ws2_32

ntohs gethostbyname socket send connect ioctlsocket WSAIoctl WSACleanup WSAStartup closesocket ntohl htons htonl recv shutdown WSAGetLastError __WSAFDIsSet accept bind inet_addr listen recvfrom select sendto WSASocketA