cobaltstrike | 02[.]08[.]2022[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
02.08.2022.exe
Size 208KB
Sample260607-ahe6haev4s
SHA256 966defeb5f18b740f90ea2f79f924537f3ca4fa7bfe137bc07b3959dc7df58f2
MD5 63340ee75a530b4c52e8b0e5554fedf4
SHA1 7a003c24909ff65f9bae57a596f9eaa6bbdfd6ea
SHA512 4219d09d5bf76db0a8fb43fe281f9efbbd18e46f3cddc7d1fbe31b41b19a1d77f3e86adbd20163975149d10f329e594c896e361817044423bfbb29a23c94f41a
SSDEEP 6144:rlEktw5WSa09CwWyfvUudZx9rBlcqducU:rlEkK5Pa+CIfP3B2d
TLSH
T12724E00D4B60421D46F14BBB0D94223251AF362CE2D8CD34FA8ABDEA8531F675D79B87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

100000 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000

http://143.92.43.153:8011/ca

Attributes

access_type
512
host
143.92.43.153,/ca
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
8011
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCWrsKh50ExVqNFHLR9QaS5NkSbyR2gWe9w7sH+W8t7gZCloWnN+qXaS07DMo0wiKd4tefByZ/XKZYrX94J2HxU3DyYnwFvVZgJ8X7yhRvG0ZsKlxF+1Ur5bf6azQ2h11tjJHwmI83e7gCGgrYhVvau2TFtPWH73zjzpA82Fcvd+QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MDDRJS)
watermark
100000

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

File Explorer

02.08.2022.exe

208KB

02.08.2022.exe

SHA256 966defeb5f18b740f90ea2f79f924537f3ca4fa7bfe137bc07b3959dc7df58f2
MD5 63340ee75a530b4c52e8b0e5554fedf4
SHA1 7a003c24909ff65f9bae57a596f9eaa6bbdfd6ea
SHA512 4219d09d5bf76db0a8fb43fe281f9efbbd18e46f3cddc7d1fbe31b41b19a1d77f3e86adbd20163975149d10f329e594c896e361817044423bfbb29a23c94f41a
SSDEEP 6144:rlEktw5WSa09CwWyfvUudZx9rBlcqducU:rlEkK5Pa+CIfP3B2d
TLSH
T12724E00D4B60421D46F14BBB0D94223251AF362CE2D8CD34FA8ABDEA8531F675D79B87
MD5 SHA1 SHA512 SSDEEP TLSH