cobaltstrike

General

Target

707dd93b9677793c4b775922836e113de3f0fa8d4abb0c1c5d02ca8df9a73793
Size

583KB
Sample

241207-pryfrsxpfr
MD5

0d7bcdc4b7e6c1da8ed8798e35d3eedd
SHA1

2d3b4d8f4ac927cde2e9f4b62aa4c1ba30c8ab20
SHA256

707dd93b9677793c4b775922836e113de3f0fa8d4abb0c1c5d02ca8df9a73793
SHA512

150bd9f458df8cc608469794f5d83f05e657d1a0599747916545402462107b2a351c512773acdad0437132965c05d2a85759dcee3f516be0a0ec579a8a3e34d5
SSDEEP

12288:TLHbgWawvqbClr63vKm+l0fEsHX0ayhv1bxxNqk:3kWawvqulCiHlBs3pyxxr

Score

10^/10

cobaltstrike 0 305419896 backdoor discovery trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

305419896

C2

http://192.168.245.129:18000/cm

Attributes

access_type
512
host
192.168.245.129,/cm
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
polling_time
60000
port_number
18000
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCLnQSO9tl+Gxs7Zf2XJClD85siRIGtCj/kyklfor3TQfGOiKkxHH0R7us2k/YSbky3ufWIk96oxvl29yw5RLofoBIEcp7ynO9IoSM1u9dPdlxQDizdxfsm4lz4cqYdtmUcuIWbK+vZj6i5KelDYTgnJIxy/WiT0GFc1r5HjenyJwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; 360space)
watermark
305419896

Extracted

Family

cobaltstrike

Botnet

0

Attributes

watermark
0

Targets

- Target
  
  1.pdf
- Size
  
  440KB
- MD5
  
  3d9eac971f137be62cf48e5c0a6c778c
- SHA1
  
  35d849fbddcf435f71aeefece7c7b88588e0230c
- SHA256
  
  ea696eed58a170e9fec62d87a36740859255b2b9ed9627e2d8f47b492091a8c7
- SHA512
  
  397472e1a74cb1652f72154cf18410c6bcfb35839702c7fee3e3b685ebec62ac0b48097fcf3ac1c222df5826e628d84128eebe16838b50222fdddeb92512a3ec
- SSDEEP
  
  6144:SyZ/lbfMG+x3sTZ0Dvw5EDnGQcwI0ltK8ZEq6fWTq2ky3hPty2eHMQU8RJVCF:SU/5J+x8TC4YGLwBEpC3hPfZUaF
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  
  beacon.exe
- Size
  
  281KB
- MD5
  
  85ac8cc1969e297bedf4200812cd73f8
- SHA1
  
  2fc02b15c604fa62d4309d1d3f4716fdcb1cfe32
- SHA256
  
  314668f7195587f4d6c161def767f7bac1b40c69618909bafc23ac3be05aa4f8
- SHA512
  
  7b1f73e33744bd69768696b128440b1c607f87727a0dca998787494895a3fa1263474e4183cc40b086c532f319c1a9cff4595bf30df361b1b0eebb3ee5598240
- SSDEEP
  
  6144:Lm82eMN2QBJkIr6ppUTn+uS1cvJ5vWJ4S2PW/rzrFQM:q82lN9BGuex9
Score

10^/10

cobaltstrike 0 305419896 backdoor trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Cobaltstrike family
  cobaltstrike
behavioral3 behavioral4