cobaltstrike | 02[.]08[.]2022[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
02.08.2022.exe
Size 206KB
Sample260221-wt6cqady5c
SHA256 483bf6173773228d01fcc5a2f214c77e52d689a80117a9f31ac0aa74802f1164
MD5 d2c4845c3630ed796f263d92a02715b5
SHA1 340303b9173bb6d4d1caaa012901773f24021abc
SHA512 058d3c509eb8875bda40850d86bd23834130d3f6b7121dddfe4fda447860705901a54c6f4ff0d35fc8546e3166b18d75ec51460dd09527a08179d595eadcfeff
SSDEEP 3072:AgMZx61G9UuCVyER1yHj08kozJYHMlTg2wk/gvWbXlR4mrvoGmyqaFl5RyA3j7vM:AgMZ7JCV7ROg8kozJo+FT4q3g2MA38
TLSH
T13824E1E91283CE07FA2525357527077CB4874048FD44975FCB69F4AB6208FBACE96990
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

1234567890 cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

1234567890

http://115.190.53.184:666/pixel.gif

Attributes

access_type
512
host
115.190.53.184,/pixel.gif
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
666
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCZa+uLx/5kQtb098G99Q6KJuQGt7ojUGsrcA0NX+EANOftlRT1GwPALrnbmGpK9YLYEcxiOdrWF97NyiV/Nf3FaN3UdONT1aXWqS3bvgA8ldXW5GPVi+EXhMQ/eKPsZJmkzRsSOEqaqYOK8+/U6ltcwHrv/UBDS62J/2LaeBHTPwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; MALC)
watermark
1234567890

Signatures

Cobaltstrike family
cobaltstrike

File Explorer

02.08.2022.exe

206KB

02.08.2022.exe

SHA256 483bf6173773228d01fcc5a2f214c77e52d689a80117a9f31ac0aa74802f1164
MD5 d2c4845c3630ed796f263d92a02715b5
SHA1 340303b9173bb6d4d1caaa012901773f24021abc
SHA512 058d3c509eb8875bda40850d86bd23834130d3f6b7121dddfe4fda447860705901a54c6f4ff0d35fc8546e3166b18d75ec51460dd09527a08179d595eadcfeff
SSDEEP 3072:AgMZx61G9UuCVyER1yHj08kozJYHMlTg2wk/gvWbXlR4mrvoGmyqaFl5RyA3j7vM:AgMZ7JCV7ROg8kozJo+FT4q3g2MA38
TLSH
T13824E1E91283CE07FA2525357527077CB4874048FD44975FCB69F4AB6208FBACE96990
MD5 SHA1 SHA512 SSDEEP TLSH