cobaltstrike | dfc381a6e8d0c46822a59f20499893a29f446b6888cbe3afe90721bae8287ebf[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
dfc381a6e8d0c46822a59f20499893a29f446b6888cbe3afe90721bae8287ebf.zip
Size 128KB
Sample241006-j99nvszfrd
SHA256 f6030de862675e369e7f42ee9d9d701f39de769e2b7fb541b2d73fe6c0a5ceee
MD5 9c3732715b997062684d1583f5c6e088
SHA1 54bfcd30c4b0dc8a449b82893358376922f4df81
SHA512 ac742c29237a34ca4695168ec1ad74fb135cf96e2b8a644f0b25bccc938fb4507afc980d2835c0201f82c3eefc315fc68b17d19171b56b269d3c384f0b555962
SSDEEP 3072:AE51TiL8IadOJwqRX/erWq3HMU12v2E6JOK/XK5zctvD6pDMW/:AgbIadOJfNerWq3J14gK5I9aMW/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

100000 cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000

http://103.27.108.111:80/cm

Attributes

access_type
512
host
103.27.108.111,/cm
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
80
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCXR6dEL2D5D5PA0hFqADKMvQ60p56YoPVQbuEx+kAUCiYpCwNgOc+QWflJNwmd1P+Qqlpsnula1MPg8XFvV1MYBNyzWtyVSkd5+12DwvJ4yQ1itGOOJt/u/dVPodhTlTLl8G//5ibjH/LXduCfPZmQUmL5kApcSCnAe+C21IpP3QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2; .NET CLR 2.0.50727)
watermark
100000

Signatures

Cobaltstrike family
cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/dfc381a6e8d0c46822a59f20499893a29f446b6888cbe3afe90721bae8287ebf

File Explorer

dfc381a6e8d0c46822a59f20499893a29f446b6888cbe3afe90721bae8287ebf.zip

.zip 128KB
dfc381a6e8d0c46822a59f20499893a29f446b6888cbe3afe90721bae8287ebf

.dll 260KB

dfc381a6e8d0c46822a59f20499893a29f446b6888cbe3afe90721bae8287ebf.zip

SHA256 f6030de862675e369e7f42ee9d9d701f39de769e2b7fb541b2d73fe6c0a5ceee
MD5 9c3732715b997062684d1583f5c6e088
SHA1 54bfcd30c4b0dc8a449b82893358376922f4df81
SHA512 ac742c29237a34ca4695168ec1ad74fb135cf96e2b8a644f0b25bccc938fb4507afc980d2835c0201f82c3eefc315fc68b17d19171b56b269d3c384f0b555962
SSDEEP 3072:AE51TiL8IadOJwqRX/erWq3HMU12v2E6JOK/XK5zctvD6pDMW/:AgbIadOJfNerWq3J14gK5I9aMW/
MD5 SHA1 SHA512 SSDEEP

Password

infected

dfc381a6e8d0c46822a59f20499893a29f446b6888cbe3afe90721bae8287ebf

IMPHASH e060daefaf7ff6c7401014aa587bc143
SHA256 dfc381a6e8d0c46822a59f20499893a29f446b6888cbe3afe90721bae8287ebf
MD5 62c351925e0217f3d54d84079f227b2a
SHA1 64b1cc26ea8c327b13ec7750e67cdf8cf490d648
SHA512 4b1cfb66b71b3987a010e336b558e5a4df53e6c21fe2c2c8e140bd37d3a0b4a83967d2153057c97b971d177fc8675fca383db777567cea67b79db91be455bd81
SSDEEP 6144:uJqXG5d1Ip8yibgkTZI6jHID90a1BXdH/:u9d6devoxlBXx
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

118272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

VirtualProtectEx TerminateProcess ReadProcessMemory WriteProcessMemory GetThreadContext ResumeThread CreateProcessA GetCurrentDirectoryW GetFullPathNameA GetLogicalDrives FindClose SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExpandEnvironmentStringsA GetFileAttributesA FindFirstFileA FindNextFileA CopyFileA MoveFileA OpenProcess GetCurrentProcessId VirtualAllocEx CreateThread OpenThread CreateToolhelp32Snapshot Thread32First Thread32Next CreateRemoteThread SetThreadContext VirtualProtect MapViewOfFile UnmapViewOfFile CreateFileMappingA Wow64GetThreadContext Wow64SetThreadContext SetLastError SetNamedPipeHandleState PeekNamedPipe CreateFileA WaitNamedPipeA GetModuleFileNameA GetComputerNameA GetVersionExA GetACP GetOEMCP HeapAlloc CreateNamedPipeA GetProcessHeap InitializeProcThreadAttributeList DeleteProcThreadAttributeList SetErrorMode UpdateProcThreadAttribute DuplicateHandle ProcessIdToSessionId Process32First Process32Next VirtualQuery ExitProcess ExitThread ConnectNamedPipe ReadFile GetCurrentThread GetCurrentProcess MultiByteToWideChar GetCurrentDirectoryA SetCurrentDirectoryA GetStartupInfoA DisconnectNamedPipe CreatePipe GetTickCount GetLocalTime CloseHandle FlushFileBuffers WriteFile WaitForSingleObject GetLastError Sleep GetModuleHandleA RaiseException SetEnvironmentVariableW SetEnvironmentVariableA LoadLibraryA VirtualFree VirtualAlloc SetEndOfFile CreateFileW WriteConsoleW SetStdHandle GetStringTypeW LCMapStringW CompareStringW HeapSize LoadLibraryW OutputDebugStringW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter RemoveDirectoryW CreateDirectoryW DeleteFileW GetFileType SetFilePointerEx SetFilePointer ReadConsoleW GetConsoleMode GetConsoleCP WideCharToMultiByte GetCPInfo GetProcAddress HeapFree FreeLibrary EncodePointer DecodePointer GetModuleHandleExW AreFileApisANSI GetSystemTimeAsFileTime HeapReAlloc GetCommandLineA GetCurrentThreadId GetStdHandle GetModuleFileNameW IsDebuggerPresent IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW LoadLibraryExW RtlUnwindEx IsValidCodePage

advapi32

GetTokenInformation OpenProcessToken CryptReleaseContext CryptAcquireContextA CryptGenRandom CheckTokenMembership DuplicateTokenEx LogonUserA LookupAccountSidA FreeSid AllocateAndInitializeSid ImpersonateNamedPipeClient RevertToSelf GetUserNameA CreateProcessWithTokenW CreateProcessWithLogonW CreateProcessAsUserA ImpersonateLoggedOnUser LookupPrivilegeValueA AdjustTokenPrivileges OpenThreadToken

wininet

InternetReadFile InternetCloseHandle InternetConnectA InternetQueryDataAvailable InternetQueryOptionA InternetSetOptionA InternetSetStatusCallback HttpOpenRequestA HttpAddRequestHeadersA HttpSendRequestA HttpQueryInfoA InternetOpenA

ws2_32

send connect WSASocketA WSAIoctl socket WSAStartup closesocket ntohl htons htonl gethostbyname ntohs ioctlsocket recv shutdown WSAGetLastError __WSAFDIsSet accept bind listen select WSACleanup