cobaltstrike | 02[.]08[.]2022[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
02.08.2022.exe
Size 206KB
Sample260116-all38aa13e
SHA256 ad656973df5ea9493d985d72da4e6e9bc234f99b816f755414e04f7c03bd8f6b
MD5 aaa7dd3bc253c2d248d06c8f72966653
SHA1 d5aa6bff0dfab19d426e317204512332b6ec857d
SHA512 140bc440a1f71692d9fcdba63fd9405724988f8bea4621519e8404d051a082d9bf845a85a99f09c7e1b7afac08170d288e01258f7252c049c13785a7045e9b63
SSDEEP 6144:2+rRsKHkuzarakonl5j4+3jus9uToStX0:2+17HRziPonlyejus9uTC
TLSH
T1EA24D12DBEB35E31565ED5A3D2C8164A1F7A48C2D0B015B3AFE0AE05F151E93C2B92E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

1234567890 cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

1234567890

http://38.148.203.82:20000/pixel

Attributes

access_type
512
host
38.148.203.82,/pixel
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
20000
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCQgi8qG2I9fy6znikdl2Up6y8w3jAq8NnyMvgLUI1OXX47jXiO5xF6EuDosruCTjM4k9PvsOVPPZd+P2GxNxrh/e9VMzP8YhEJm5LTsriP+7M/m9y2p79la2kEBIN37WHtC4MU4XBHpJMpElX6352ugExdeVaogVWbwop6asY7wwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; yie9)
watermark
1234567890

Signatures

Cobaltstrike family
cobaltstrike

File Explorer

02.08.2022.exe

206KB

02.08.2022.exe

SHA256 ad656973df5ea9493d985d72da4e6e9bc234f99b816f755414e04f7c03bd8f6b
MD5 aaa7dd3bc253c2d248d06c8f72966653
SHA1 d5aa6bff0dfab19d426e317204512332b6ec857d
SHA512 140bc440a1f71692d9fcdba63fd9405724988f8bea4621519e8404d051a082d9bf845a85a99f09c7e1b7afac08170d288e01258f7252c049c13785a7045e9b63
SSDEEP 6144:2+rRsKHkuzarakonl5j4+3jus9uToStX0:2+17HRziPonlyejus9uTC
TLSH
T1EA24D12DBEB35E31565ED5A3D2C8164A1F7A48C2D0B015B3AFE0AE05F151E93C2B92E4
MD5 SHA1 SHA512 SSDEEP TLSH