cobaltstrike | 1a56eed2e6721098adb95de0384b858d0ffc3bd2e1e373bf4b5d384b764c003e

Sharing

Copy URL Twitter E-mail

General

Target
1a56eed2e6721098adb95de0384b858d0ffc3bd2e1e373bf4b5d384b764c003e
Size 275KB
Sample260511-hn2wfsct41
SHA256 1a56eed2e6721098adb95de0384b858d0ffc3bd2e1e373bf4b5d384b764c003e
MD5 3f0d049524a1c45e8e5a06291acce113
SHA1 dad74143e01d289de3a9cf37f89552fe6c41d1b1
SHA512 4031ecd6571bbee992638d29c144142eac9a371adef253445c992ff30f16cce1562ac3cce4adb37c879f065ce160a5a7b647ec62f59cd08d367e8bdeef3815b9
SSDEEP 6144:YTOjFfIIyN0EVizLs9dfZWZKo9TOdwsXZzy7L:YTUfIzNlxBWZZ5OdwoZ2
TLSH
T1D054BD9AA160D81ED866EDB7541A17358110CB0FA7777E42CD4392F94F8B3AED22C933
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

391144938 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

391144938

http://180.76.141.175:443/push

Attributes

access_type
512
host
180.76.141.175,/push
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCMUWx5grE9ueXO4AO8Iv7+2pbOGE9IMY8xvgl82xo1HKwajefnxGYWJzE3I4hiGZI5B9Oney+BWq84SPphyqgGWxGZ6bhRwMaI6oaUM21nqjBA/NrueURM3VfygnYT33qcDJaiee2iSVR5CTTtrKrKV1arMzFfGGlrdUkZmofLHQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
watermark
391144938

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a56eed2e6721098adb95de0384b858d0ffc3bd2e1e373bf4b5d384b764c003e

File Explorer

1a56eed2e6721098adb95de0384b858d0ffc3bd2e1e373bf4b5d384b764c003e

.exe 275KB

1a56eed2e6721098adb95de0384b858d0ffc3bd2e1e373bf4b5d384b764c003e

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 1a56eed2e6721098adb95de0384b858d0ffc3bd2e1e373bf4b5d384b764c003e
MD5 3f0d049524a1c45e8e5a06291acce113
SHA1 dad74143e01d289de3a9cf37f89552fe6c41d1b1
SHA512 4031ecd6571bbee992638d29c144142eac9a371adef253445c992ff30f16cce1562ac3cce4adb37c879f065ce160a5a7b647ec62f59cd08d367e8bdeef3815b9
SSDEEP 6144:YTOjFfIIyN0EVizLs9dfZWZKo9TOdwsXZzy7L:YTUfIzNlxBWZZ5OdwoZ2
TLSH
T1D054BD9AA160D81ED866EDB7541A17358110CB0FA7777E42CD4392F94F8B3AED22C933
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9886

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

1a56eed2e6721098adb95de0384b858d0ffc3bd2e1e373bf4b5d384b764c003e

mscoree

dotnet