cobaltstrike

General

Target

1164e9076b83f9852a50a50b9cabc12f71b0706e60d4b233573a006e73ca48a3
Size

2.6MB
Sample

240907-kdxvvsvbkn
MD5

0844e4f2ed1b8c9f6af2b6e5605ef48e
SHA1

42c91c3d19643c821635bdf36541ee9480bc5c89
SHA256

1164e9076b83f9852a50a50b9cabc12f71b0706e60d4b233573a006e73ca48a3
SHA512

84386b3e496005fb36deda9a6ed2a865c1b8ed0785b6bd8625ddc4fb6cbdcfe491dd17f3fdb1aa27545d978ff333277ae16789bf873c0e2ca49bbb9677130d4e
SSDEEP

49152:VuWH3n+Yn+Hx3k8kDOEqjKbgTz8VzN7Ner+PFBTUAgQc7rX13FePa1+63ux+aV:VuWDQkBDOxK88VzxNe+dBTLgxa8uxJV

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000000

C2

http://www.microssoftt.site:8443/jquery-3.3.1.min.js

Attributes

access_type
512
beacon_type
2048
host
www.microssoftt.site,/jquery-3.3.1.min.js
http_header1
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAgUmVmZXJlcjogaHR0cDovL2NvZGUuanF1ZXJ5LmNvbS8AAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADQAAAAIAAAAJX19jZmR1aWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAgUmVmZXJlcjogaHR0cDovL2NvZGUuanF1ZXJ5LmNvbS8AAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADwAAAA0AAAAFAAAACF9fY2ZkdWlkAAAABwAAAAEAAAAPAAAADQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
9472
polling_time
45000
port_number
8443
sc_process32
%windir%\syswow64\dllhost.exe
sc_process64
%windir%\sysnative\dllhost.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDh6qZq3bXvZiWwrESQIcmXY6PK4DEykVspGMRn9I0rftzL2p/I1Pciae+B+BOjA3FcZ7jAuvS936MYF+Bc2r+y04WNz/mNl47RStHXS0RjOkiQpfe7yeQydtcNtK8S99sf64KCsLo3go4nSRk7QEG3g6W0fgnrdKHdpAnKQ2UT3QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4.234810624e+09
unknown2
AAAABAAAAAEAAAXyAAAAAgAAAFQAAAACAAAPWwAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/jquery-3.3.2.min.js
user_agent
Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
watermark
100000000

Targets

- Target
  
  1164e9076b83f9852a50a50b9cabc12f71b0706e60d4b233573a006e73ca48a3
- Size
  
  2.6MB
- MD5
  
  0844e4f2ed1b8c9f6af2b6e5605ef48e
- SHA1
  
  42c91c3d19643c821635bdf36541ee9480bc5c89
- SHA256
  
  1164e9076b83f9852a50a50b9cabc12f71b0706e60d4b233573a006e73ca48a3
- SHA512
  
  84386b3e496005fb36deda9a6ed2a865c1b8ed0785b6bd8625ddc4fb6cbdcfe491dd17f3fdb1aa27545d978ff333277ae16789bf873c0e2ca49bbb9677130d4e
- SSDEEP
  
  49152:VuWH3n+Yn+Hx3k8kDOEqjKbgTz8VzN7Ner+PFBTUAgQc7rX13FePa1+63ux+aV:VuWDQkBDOxK88VzxNe+dBTLgxa8uxJV
Score

10^/10

cobaltstrike 100000000 backdoor discovery trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2