cobaltstrike | 02[.]08[.]2022[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
02.08.2022.exe
Size 208KB
Sample260209-anrfqaf15e
SHA256 d1bc0d1149418536755b00eb16ffaae1286220a7cd77ad83c012fd9be93a169b
MD5 72963ef9650c1438d76f6f5b7d14cc79
SHA1 208ba6cba77f27fbb4c8ebcfd58026da8957acd3
SHA512 d89a5bb77b8609d1905536b8ef2d88557d7b6b1ffed173e0d74496838b2d5f05c21282597a34ce6454bf9a472846518bf063254879330daaa7a71dd6017d816f
SSDEEP 6144:sht/A+wBWYl1Y/CdyN+wAtsuCFwP6gG2kA+d:shtlkGadyN3Y6gVk1
TLSH
T1CC24F1DB47F22D75F6B2E213FCDAC66CCCC06B5EAC0887AABA46912DA1441F50D67035
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

100000 cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000

http://new.sys-update.online:80/g.pixel

Attributes

access_type
512
host
new.sys-update.online,/g.pixel
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
80
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC1t/VaKkS3C1HlHPlUpjIBo3uQNOGhw5HazP7gCYU2dEQe9q7zLDsScNwPPImx8uQ93BoWAwstwil2VtH5anvetWv+vRU/OesKk2O3+fz/KEy/6Oviy4Otcjwa8a0t+w2amze/JH2xiWVNKuMLFQA+SeUMwpaQHJZAcL01TJPhQwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; MANM)
watermark
100000

Signatures

Cobaltstrike family
cobaltstrike

File Explorer

02.08.2022.exe

208KB

02.08.2022.exe

SHA256 d1bc0d1149418536755b00eb16ffaae1286220a7cd77ad83c012fd9be93a169b
MD5 72963ef9650c1438d76f6f5b7d14cc79
SHA1 208ba6cba77f27fbb4c8ebcfd58026da8957acd3
SHA512 d89a5bb77b8609d1905536b8ef2d88557d7b6b1ffed173e0d74496838b2d5f05c21282597a34ce6454bf9a472846518bf063254879330daaa7a71dd6017d816f
SSDEEP 6144:sht/A+wBWYl1Y/CdyN+wAtsuCFwP6gG2kA+d:shtlkGadyN3Y6gVk1
TLSH
T1CC24F1DB47F22D75F6B2E213FCDAC66CCCC06B5EAC0887AABA46912DA1441F50D67035
MD5 SHA1 SHA512 SSDEEP TLSH