cobaltstrike | 891e8a6c94b623f5df030a4a4b9fe82a2d96edf1fe4e422ffcade562a42d59ea[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
891e8a6c94b623f5df030a4a4b9fe82a2d96edf1fe4e422ffcade562a42d59ea.zip
Size 130KB
Sample260702-bvdzmsax8w
SHA256 bbc579c382a3f096ec9291c83f68536270691037ea462a152759cf562ebcf1b7
MD5 1dcde033451a2b0ac269f70fe8f450de
SHA1 dc932e9dcea38ab523d20558c568dc8fcee556b9
SHA512 0c0602a17682f5c0502b204e13553c9d7837f517fbd806fbed0c05dda382441e85f8b789c0f781ddd1ef067bc7966450b4ade8c342785d3c0dacc677cb3e49d0
SSDEEP 3072:BuEa3LPeMEWJVB1K8NusOfJEKo12iTTJbINMng4XDBTP5tkqSGxQc:BupLmME0w7xo2iT6NBqBP5tCc
TLSH
T1B4D3122D6D24B7C74AAFAFB355F7708E08E3403B036164BD36227468795E4D6CA92353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

987654321 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

987654321

http://192.168.111.129:80/match

Attributes

access_type
512
host
192.168.111.129,/match
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
80
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC0kFrXz6mQxafTpFR9JMElG4b9JogpX1EBk4OHg+HpL8LR8DMHJ2RIZXzfmCZW0j9x7AbDl/C6opT7hD4+8FBhZetbnbrawTgLofmOiGvavMR9e2PMUpGKQUOWUlQZcl5NGfXyrvenNnpWbjziRJ1qkm5ghFU2MbBeSo7ktJ9O2QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727)
watermark
987654321

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/891e8a6c94b623f5df030a4a4b9fe82a2d96edf1fe4e422ffcade562a42d59ea

File Explorer

891e8a6c94b623f5df030a4a4b9fe82a2d96edf1fe4e422ffcade562a42d59ea.zip

.zip 130KB
891e8a6c94b623f5df030a4a4b9fe82a2d96edf1fe4e422ffcade562a42d59ea

.dll 272KB

891e8a6c94b623f5df030a4a4b9fe82a2d96edf1fe4e422ffcade562a42d59ea.zip

SHA256 bbc579c382a3f096ec9291c83f68536270691037ea462a152759cf562ebcf1b7
MD5 1dcde033451a2b0ac269f70fe8f450de
SHA1 dc932e9dcea38ab523d20558c568dc8fcee556b9
SHA512 0c0602a17682f5c0502b204e13553c9d7837f517fbd806fbed0c05dda382441e85f8b789c0f781ddd1ef067bc7966450b4ade8c342785d3c0dacc677cb3e49d0
SSDEEP 3072:BuEa3LPeMEWJVB1K8NusOfJEKo12iTTJbINMng4XDBTP5tkqSGxQc:BupLmME0w7xo2iT6NBqBP5tCc
TLSH
T1B4D3122D6D24B7C74AAFAFB355F7708E08E3403B036164BD36227468795E4D6CA92353
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

891e8a6c94b623f5df030a4a4b9fe82a2d96edf1fe4e422ffcade562a42d59ea

IMPHASH 036fe63de7eb1468fd90eb5a61bcbdf8
SHA256 891e8a6c94b623f5df030a4a4b9fe82a2d96edf1fe4e422ffcade562a42d59ea
MD5 ffa807a5ef0ae35bbd1aeef1d41df5a8
SHA1 7f32db8b64e862aa390537bc705aa06934c35c67
SHA512 00bd70683b2a917e81379bc3e3d7861a8ba01583197db77bd3a2b8c90ca1ef20929af1ab2db9f66e6cf8a21347dc74bb620935594536cd31a1d39c8b8fc4be3f
SSDEEP 3072:rzbINhWl+CIbfqqEVxtfg8jtfDCJS4l9JTFyG+JteEzCnL7zMGIkfhUYJF6vzHkc:rzbUWootfDCvT4ZTXzCLnIk5UDrrKM
TLSH
T1B3446B8572A43CF5E867D73ACA57461BEFF27C564670D70F03640AAA0F233A1A22D752
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

120896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetCurrentProcess GetCurrentThread ReadFile ConnectNamedPipe CreateNamedPipeA VirtualProtectEx TerminateProcess ReadProcessMemory WriteProcessMemory GetThreadContext ResumeThread CreateProcessA GetCurrentDirectoryW GetFullPathNameA GetLogicalDrives FindClose SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExpandEnvironmentStringsA GetFileAttributesA FindFirstFileA FindNextFileA CopyFileA MoveFileA OpenProcess GetCurrentProcessId VirtualAllocEx CreateThread OpenThread CreateToolhelp32Snapshot Thread32First Thread32Next CreateRemoteThread SetThreadContext Wow64GetThreadContext Wow64SetThreadContext SetLastError SetNamedPipeHandleState PeekNamedPipe CreateFileA WaitNamedPipeA GetModuleFileNameA GetComputerNameA GetVersionExA GetACP GetOEMCP GetStartupInfoA InitializeProcThreadAttributeList DeleteProcThreadAttributeList SetErrorMode UpdateProcThreadAttribute DuplicateHandle ProcessIdToSessionId Process32First Process32Next VirtualQuery ExitProcess ExitThread DisconnectNamedPipe CreatePipe GetTickCount GetLocalTime FlushFileBuffers WriteFile WaitForSingleObject Sleep GetModuleHandleA LoadLibraryA CreateFileMappingA UnmapViewOfFile MapViewOfFile CloseHandle GetLastError HeapFree HeapAlloc HeapDestroy HeapCreate RaiseException SetEnvironmentVariableW SetEnvironmentVariableA VirtualProtect VirtualFree VirtualAlloc SetEndOfFile CreateFileW WriteConsoleW SetStdHandle GetStringTypeW LCMapStringW CompareStringW HeapSize LoadLibraryW OutputDebugStringW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter RemoveDirectoryW CreateDirectoryW DeleteFileW GetFileType SetFilePointerEx SetFilePointer ReadConsoleW GetConsoleMode GetConsoleCP WideCharToMultiByte GetCPInfo IsValidCodePage RtlUnwindEx GetProcAddress GetProcessHeap FreeLibrary EncodePointer DecodePointer GetModuleHandleExW AreFileApisANSI GetSystemTimeAsFileTime HeapReAlloc GetCommandLineA GetCurrentThreadId GetStdHandle GetModuleFileNameW IsDebuggerPresent IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW LoadLibraryExW

advapi32

GetTokenInformation OpenProcessToken CryptReleaseContext CryptAcquireContextA CryptGenRandom CheckTokenMembership DuplicateTokenEx LogonUserA LookupAccountSidA FreeSid AllocateAndInitializeSid ImpersonateNamedPipeClient RevertToSelf GetUserNameA CreateProcessWithTokenW CreateProcessWithLogonW CreateProcessAsUserA ImpersonateLoggedOnUser LookupPrivilegeValueA AdjustTokenPrivileges OpenThreadToken

wininet

InternetReadFile InternetCloseHandle InternetConnectA InternetQueryDataAvailable InternetQueryOptionA InternetSetOptionA InternetSetStatusCallback HttpOpenRequestA HttpAddRequestHeadersA HttpSendRequestA HttpQueryInfoA InternetOpenA

ws2_32

ntohs gethostbyname socket send connect ioctlsocket WSAIoctl WSACleanup WSAStartup closesocket ntohl htons htonl recv shutdown WSAGetLastError __WSAFDIsSet accept bind inet_addr listen recvfrom select sendto WSASocketA