cobaltstrike | 8a4d94bf1f61564441701ef429b0e23f0b4dd425d6b1f9fc7b2237da3638f10f

General

Target
97d294f3d7297c8ea00ed0d5b862885236115cee539d0a4281b7e80d5fbc4de9.zip
Size 112KB
Sample240802-efet6sygrc
SHA256 8a4d94bf1f61564441701ef429b0e23f0b4dd425d6b1f9fc7b2237da3638f10f
MD5 dc0bd039d7644f1c40aec2363f52bb7d
SHA1 47b31e16e4d15184dff12cd2c4c829f966a45d54
SHA512 61e0387fc00991eaf97901af64e6a1465b80bfe9916db91ea8c9137403a3f50b518d27b83b7c512f0fbac01e55ae93dbae73fefa9c844fca081e6baee95a71fa
SSDEEP 3072:TuHkOPdk0sVG1WMsom+V19VNfZ3FwKcxNWC:TuHfGzM4lH+xfZmK+0C
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000

C2

http://192.34.56.49:80/IE9CompatViewList.xml

Attributes

access_type
512
host
192.34.56.49,/IE9CompatViewList.xml
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
80
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDhw/moQ0VdyB56chcMLnDtUhv1UVM03XjgzN/oDf0LQsMcu+MMxmZr9HDUiK7XGswd6zX49j/Uu3CBnLBykLhefJFzZlH6ORRDAELHOc9oOsdRwWjxBYcPgGhXp1tNUcJEadPAxRYj7CQKLqdOQ3TZKEYWR7mGQWGrtK5BKlzAzQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
watermark
100000

Targets

- Target
  97d294f3d7297c8ea00ed0d5b862885236115cee539d0a4281b7e80d5fbc4de9
- Size 208KB
- SHA256 97d294f3d7297c8ea00ed0d5b862885236115cee539d0a4281b7e80d5fbc4de9
- MD5 45ba495d35f7e0983558bd4efe9ee091
- SHA1 4f4dcac8ceba7c82a9d89fe53dedc658c98cadf7
- SHA512 2ff20645d46450ab560d890b4788f6d54cc46b2689e9e8df140b79f11207ddf49bb38f08178db26113b79456758d76a4cc09d59bc8670b548ac546815e9a288d
- SSDEEP 3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUkMY5u:LIDff9D8C6XYRw6MT2DEj
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2