cobaltstrike | 02[.]08[.]2022[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
02.08.2022.exe
Size 206KB
Sample260210-cbl2ksas2d
SHA256 40425fd23bcc042d976bfa1b72f5e9c6140a26f93cf4a6fe3dbeb6b127face47
MD5 1e2337c2937eced8af54f4265c366884
SHA1 1952723caa2521ecbaa4dec6c52c3d5bba3df4f5
SHA512 36297ceb337dda71af0811a0ae58aa4f5b4fec7f7125053540f840ce7360f9b32ddf5ebd96a76975f02d7289dec3ce1e918d25d2cb2ffa3f2e55b2391b3cbb8f
SSDEEP 6144:UF0P72k7+5Z9icPG5hXujsSwfdhzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzj:UF0DtwZ9NAUI1fT
TLSH
T10924E073DBC74651A651BE42CECADE14748B47B060A281D9FD97AF3A3063365CE1B30A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

1234567890 cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

1234567890

http://36.140.162.173:4433/ga.js

Attributes

access_type
512
beacon_type
2048
host
36.140.162.173,/ga.js
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
4433
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCjqVSG7X2yu66cZDCIKnY5VZig2gaehfmoUG3fRoZyIdwQJ4EfgHVqroeSnlU/lBI/Y3wig5BIkMgDLcJCPutbBwJr5hQVrcvuIL2AUDef1o6XYFp1k81kgfvTct3vrdkkhbzD6a1oh3yiV/jHaHMq5tqSsdkk6CMegZwm+7iZnQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; MANM)
watermark
1234567890

Signatures

Cobaltstrike family
cobaltstrike

File Explorer

02.08.2022.exe

206KB

02.08.2022.exe

SHA256 40425fd23bcc042d976bfa1b72f5e9c6140a26f93cf4a6fe3dbeb6b127face47
MD5 1e2337c2937eced8af54f4265c366884
SHA1 1952723caa2521ecbaa4dec6c52c3d5bba3df4f5
SHA512 36297ceb337dda71af0811a0ae58aa4f5b4fec7f7125053540f840ce7360f9b32ddf5ebd96a76975f02d7289dec3ce1e918d25d2cb2ffa3f2e55b2391b3cbb8f
SSDEEP 6144:UF0P72k7+5Z9icPG5hXujsSwfdhzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzj:UF0DtwZ9NAUI1fT
TLSH
T10924E073DBC74651A651BE42CECADE14748B47B060A281D9FD97AF3A3063365CE1B30A
MD5 SHA1 SHA512 SSDEEP TLSH