Overview

overview

10

Static

static

10

5cec1e561e...ae.dll

windows7-x64

1

5cec1e561e...ae.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    901eceb888a64c4cda16730d76232cc5957d2b6ae19016251e583f546c48ac64

  • Size

    127KB

  • MD5

    c473e03163fa7caf4d6a03603695f1d8

  • SHA1

    1a2874a5857148bc2e20a7ca32a944cbac050330

  • SHA256

    901eceb888a64c4cda16730d76232cc5957d2b6ae19016251e583f546c48ac64

  • SHA512

    b380bb3959eb372c8cca43d352e4b635588073be522f1d4239eb30fed766078ca5db89ad124aa0f4b7116a80353540670f3f4e226f305aa2e4b508f7d379f317

  • SSDEEP

    3072:MboGljm/9O21a/RVsX64OdDuKWVPIItrtL78emZk3OGp0Q5o:Wo6iha/PAOpuKPiRzmkp0Ao

Score
10/10
987654321cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

987654321

Attributes
  • beacon_type

    1024

  • host

    10.10.10.129

  • http_header1

    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • polling_time

    10000

  • port_number

    6996

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCDEW0BCxyEcBREtTV53Bv//2cZMQIlxGEeF6OpvgjsNZgXWWiJz1Pz7DvSwa4uvtGwycIjLe9TaYp3XpqdbNtz4ijyeubzLvYy0rDszUy3wLk+ZLt0nlaqRVtx4/AE26M56h78lfF2PTEApgn6MNjTvAqjkyB3TxDc5/44LhN7AwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • watermark

    987654321

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 901eceb888a64c4cda16730d76232cc5957d2b6ae19016251e583f546c48ac64
    .zip

    Password: infected

  • 5cec1e561e324213d0d76cfc728f37d6730a4103508af3d1cf93fb2f96d588ae
    .dll windows:5 windows x64 arch:x64

    d1076244bb8a79b8df5922494baf7e53


    Headers

    Imports

    Exports

    Sections