cobaltstrike | 02[.]08[.]20227[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
02.08.20227.exe
Size 208KB
Sample240829-nreg8a1flj
SHA256 73055eb742b6cfc01086f8e1e694de043192a5786101e5dfc32e5248aa6cab59
MD5 eb059342cb8ede353c1d2e5040f37100
SHA1 c3efaab541538fb9c50a14d699d41032fac50170
SHA512 a7af5ea9f2085c1f8706229b5ad9bdfc46c4cc29c8e94c3b2325cc9ec3439cbd0ccbe95cc29aad48f79250af0638602af8341fe89325c81c037f33c1750efe3e
SSDEEP 3072:Ow7T6+/hE2JLQTf7jQ6QH6G8CbA6FO3VO43v1kf21sh5Ey3LKdLrxfwRPPPvk6CH:O+L5hiUlFO443NGCieLrxIE0E
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

100000 cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000

http://175.178.179.183:808/pixel

Attributes

access_type
512
host
175.178.179.183,/pixel
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
808
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC9bGFZyvZyumf3PlpeADjx29GOic+gAbXx/jlN3LMTAgaqfMJyej8ZyaoEyYcmY3ucr4jih9XcEMYtCwgb41+njuCsa7pBhZtsGOvGSB0d4wtHMAeHdMZfd8tATSKdkk6QldNk0n/TzVqg1yu88wxOFbxZRQAL3tuQpomSDftifQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
watermark
100000

Signatures

Cobaltstrike family
cobaltstrike

File Explorer

02.08.20227.exe

208KB

02.08.20227.exe

SHA256 73055eb742b6cfc01086f8e1e694de043192a5786101e5dfc32e5248aa6cab59
MD5 eb059342cb8ede353c1d2e5040f37100
SHA1 c3efaab541538fb9c50a14d699d41032fac50170
SHA512 a7af5ea9f2085c1f8706229b5ad9bdfc46c4cc29c8e94c3b2325cc9ec3439cbd0ccbe95cc29aad48f79250af0638602af8341fe89325c81c037f33c1750efe3e
SSDEEP 3072:Ow7T6+/hE2JLQTf7jQ6QH6G8CbA6FO3VO43v1kf21sh5Ey3LKdLrxfwRPPPvk6CH:O+L5hiUlFO443NGCieLrxIE0E
MD5 SHA1 SHA512 SSDEEP