cobaltstrike | 02[.]08[.]2022[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
02.08.2022.exe
Size 218KB
Sample260311-pe43saew6v
SHA256 a93d5cda54ea9a3837d18bd95e54bf93cd8fd0ceeeac2d467e8026b6441a6e7b
MD5 bb84628e340e8aded35257a1218aa530
SHA1 9106e1aafdd423c081481bb9e64cfabc824d2e04
SHA512 ccc87126619d18f8e6f0eaa3c8bd92ad940b83f6c954627a696bf75650d6c5d813ee0bc707ef79c127f59b95e290137a332b95fafd536cba46976ccb80c50985
SSDEEP 6144:S0BKQZFTK+2QIvJR8BBfFNk8461dyJCo6I8h:j0QnKzQmqBd/kRJx8h
TLSH
T13B24CF035C7717F8F9897E906142C56CA043B3D0C8E5B774EEC87B6627B708868E696E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

391144938 cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

391144938

http://117.72.191.140:8028/updates.rss

Attributes

access_type
512
host
117.72.191.140,/updates.rss
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
8028
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCs8wQRJjerDbjKrECrYu+IhVM4rNj4R7lUwHHaq2m5JLyhR+PObavdJRkxwKNFUOKiZnVlkYR5ShBjArd267g+bQI6HcQYUsE7tv8o8GHdzc1t0MD+oIbdxzWw6Rsa2o3CmSrDvp9BCkDkAsxlLuthzMAlyCLHn83ESMwpUmsrRwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MALCJS)
watermark
391144938

Signatures

Cobaltstrike family
cobaltstrike

File Explorer

02.08.2022.exe

218KB

02.08.2022.exe

SHA256 a93d5cda54ea9a3837d18bd95e54bf93cd8fd0ceeeac2d467e8026b6441a6e7b
MD5 bb84628e340e8aded35257a1218aa530
SHA1 9106e1aafdd423c081481bb9e64cfabc824d2e04
SHA512 ccc87126619d18f8e6f0eaa3c8bd92ad940b83f6c954627a696bf75650d6c5d813ee0bc707ef79c127f59b95e290137a332b95fafd536cba46976ccb80c50985
SSDEEP 6144:S0BKQZFTK+2QIvJR8BBfFNk8461dyJCo6I8h:j0QnKzQmqBd/kRJx8h
TLSH
T13B24CF035C7717F8F9897E906142C56CA043B3D0C8E5B774EEC87B6627B708868E696E
MD5 SHA1 SHA512 SSDEEP TLSH