cobaltstrike | fa54e7eaa471c48da5e8d87cf8cd1af50fb2ff6b216c9c2121efa8aecf7f6015[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
fa54e7eaa471c48da5e8d87cf8cd1af50fb2ff6b216c9c2121efa8aecf7f6015.zip
Size 130KB
Sample241014-v8p4ls1epl
SHA256 790d6e594f9f143c09a6f52944b196b996cce8217155fe0b2cb355de941317e2
MD5 cbd26c6e9b5c043e210ce099306bc1bb
SHA1 c97b574865fbd17f0697505490fdd7d9f0634a3a
SHA512 03e69dfe0a883ccc7624c48522ffe7f17dfc1daf278e7b43e06b8b1c5c079df6f4a38989b9fd9737b03d3022f932c133ec283ee748260f67c0c7ff0c148f3d08
SSDEEP 3072:a1gsJ4HHpF8DZuC+pvUlwJ+3GPwoRqWWk6+LSrqE:qLG5CcvUGK83RxzLSuE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

391144938 cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

391144938

http://101.34.205.237:3456/match

Attributes

access_type
512
host
101.34.205.237,/match
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
3456
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCBCdAcGgbmSD8OnY3CXoARWSARv9sdG/r4LvD9JUAmq3RmxdqlXbXPK0DA6j/wrGbB2pnQbZI4BsVEvC8//qXWMSxAiI7IushvndQeJG0a2T1dBidxsoef7wzmj8Gw7lu42PaYOaRQijFCxHLHNUrwpUpweDCjRjQQnyRofQ3A0QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MALC)
watermark
391144938

Signatures

Cobaltstrike family
cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/fa54e7eaa471c48da5e8d87cf8cd1af50fb2ff6b216c9c2121efa8aecf7f6015

File Explorer

fa54e7eaa471c48da5e8d87cf8cd1af50fb2ff6b216c9c2121efa8aecf7f6015.zip

.zip 130KB
fa54e7eaa471c48da5e8d87cf8cd1af50fb2ff6b216c9c2121efa8aecf7f6015

.dll 272KB

fa54e7eaa471c48da5e8d87cf8cd1af50fb2ff6b216c9c2121efa8aecf7f6015.zip

SHA256 790d6e594f9f143c09a6f52944b196b996cce8217155fe0b2cb355de941317e2
MD5 cbd26c6e9b5c043e210ce099306bc1bb
SHA1 c97b574865fbd17f0697505490fdd7d9f0634a3a
SHA512 03e69dfe0a883ccc7624c48522ffe7f17dfc1daf278e7b43e06b8b1c5c079df6f4a38989b9fd9737b03d3022f932c133ec283ee748260f67c0c7ff0c148f3d08
SSDEEP 3072:a1gsJ4HHpF8DZuC+pvUlwJ+3GPwoRqWWk6+LSrqE:qLG5CcvUGK83RxzLSuE
MD5 SHA1 SHA512 SSDEEP

Password

infected

fa54e7eaa471c48da5e8d87cf8cd1af50fb2ff6b216c9c2121efa8aecf7f6015

IMPHASH 036fe63de7eb1468fd90eb5a61bcbdf8
SHA256 fa54e7eaa471c48da5e8d87cf8cd1af50fb2ff6b216c9c2121efa8aecf7f6015
MD5 91a3c680cdebe582b363e01bacf7b26a
SHA1 424180860b5547638bfa007adf6c85c4fe45ff71
SHA512 b9d132108be3ca63041a46d6dc96daec2f5557711abcc9b58283206d5415a9232a7883f9af876befd2e64cfb317d8f7c870be6d756018e98336c4093fd1cbbf8
SSDEEP 3072:rzbINhWl+CIbfqqEVxtfg8jtfDCJS4l9JTFyG+JteEzCnL7zfGIkfhUYJF6vzHkN:rzbUWootfDCvT4ZTXzCLmIk5UDSrKM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

120896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetCurrentProcess GetCurrentThread ReadFile ConnectNamedPipe CreateNamedPipeA VirtualProtectEx TerminateProcess ReadProcessMemory WriteProcessMemory GetThreadContext ResumeThread CreateProcessA GetCurrentDirectoryW GetFullPathNameA GetLogicalDrives FindClose SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExpandEnvironmentStringsA GetFileAttributesA FindFirstFileA FindNextFileA CopyFileA MoveFileA OpenProcess GetCurrentProcessId VirtualAllocEx CreateThread OpenThread CreateToolhelp32Snapshot Thread32First Thread32Next CreateRemoteThread SetThreadContext Wow64GetThreadContext Wow64SetThreadContext SetLastError SetNamedPipeHandleState PeekNamedPipe CreateFileA WaitNamedPipeA GetModuleFileNameA GetComputerNameA GetVersionExA GetACP GetOEMCP GetStartupInfoA InitializeProcThreadAttributeList DeleteProcThreadAttributeList SetErrorMode UpdateProcThreadAttribute DuplicateHandle ProcessIdToSessionId Process32First Process32Next VirtualQuery ExitProcess ExitThread DisconnectNamedPipe CreatePipe GetTickCount GetLocalTime FlushFileBuffers WriteFile WaitForSingleObject Sleep GetModuleHandleA LoadLibraryA CreateFileMappingA UnmapViewOfFile MapViewOfFile CloseHandle GetLastError HeapFree HeapAlloc HeapDestroy HeapCreate RaiseException SetEnvironmentVariableW SetEnvironmentVariableA VirtualProtect VirtualFree VirtualAlloc SetEndOfFile CreateFileW WriteConsoleW SetStdHandle GetStringTypeW LCMapStringW CompareStringW HeapSize LoadLibraryW OutputDebugStringW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter RemoveDirectoryW CreateDirectoryW DeleteFileW GetFileType SetFilePointerEx SetFilePointer ReadConsoleW GetConsoleMode GetConsoleCP WideCharToMultiByte GetCPInfo IsValidCodePage RtlUnwindEx GetProcAddress GetProcessHeap FreeLibrary EncodePointer DecodePointer GetModuleHandleExW AreFileApisANSI GetSystemTimeAsFileTime HeapReAlloc GetCommandLineA GetCurrentThreadId GetStdHandle GetModuleFileNameW IsDebuggerPresent IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW LoadLibraryExW

advapi32

GetTokenInformation OpenProcessToken CryptReleaseContext CryptAcquireContextA CryptGenRandom CheckTokenMembership DuplicateTokenEx LogonUserA LookupAccountSidA FreeSid AllocateAndInitializeSid ImpersonateNamedPipeClient RevertToSelf GetUserNameA CreateProcessWithTokenW CreateProcessWithLogonW CreateProcessAsUserA ImpersonateLoggedOnUser LookupPrivilegeValueA AdjustTokenPrivileges OpenThreadToken

wininet

InternetReadFile InternetCloseHandle InternetConnectA InternetQueryDataAvailable InternetQueryOptionA InternetSetOptionA InternetSetStatusCallback HttpOpenRequestA HttpAddRequestHeadersA HttpSendRequestA HttpQueryInfoA InternetOpenA

ws2_32

ntohs gethostbyname socket send connect ioctlsocket WSAIoctl WSACleanup WSAStartup closesocket ntohl htons htonl recv shutdown WSAGetLastError __WSAFDIsSet accept bind inet_addr listen recvfrom select sendto WSASocketA