cobaltstrike | 4942419b35e1bd4fa2183b9b1195ff0a0c807c04d74591f05fea4cae87e376a4[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
4942419b35e1bd4fa2183b9b1195ff0a0c807c04d74591f05fea4cae87e376a4.zip
Size 128KB
Sample260708-dv937aaz2p
SHA256 c3c458aeae0d4a8a9fd7a595b4581b2772e947db68a829afeb93711b6e250faf
MD5 f2799baf71d3544ae4d0219498b4bc41
SHA1 c40eddd11d7b7de260c24e05e933435208f91b42
SHA512 ffc9b3ee7c27cfa1dcc66f034b1592972887dd5ad9031cbe97f91cfe0008924a9ad2ea92b0959848d5060e2987a2b4d88e6fb406a6b02385b26f9609a9a4f2cc
SSDEEP 3072:pTI8+mSX74sDts09ThqHHMinzLGGlK19pMG+881a72/i2:pTI8+/vDbGsq/lKgal2
TLSH
T176D3124A518D71BB9EEF217CE49831B7C260BDC2505F5F82DA6458A80B09BED373C84B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

100000 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000

http://47.122.62.142:8888/pixel

Attributes

access_type
512
host
47.122.62.142,/pixel
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
8888
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCh0za0Qa9SYYDoEsw/0iWbtiZRCS72tLSX//tkCXAWflx76gHxb1LZZ47HvucBKdbcN80l9fONI7tSWrvXkadgsIVIglr68C4ltc4Aj/Oll/p/5ZLRHdy7axd9HNMCS0ql9Goi5I6URM73/rzIwfPdEz5IzfSBasjiFojKnP9UIwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2)
watermark
100000

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/4942419b35e1bd4fa2183b9b1195ff0a0c807c04d74591f05fea4cae87e376a4

File Explorer

4942419b35e1bd4fa2183b9b1195ff0a0c807c04d74591f05fea4cae87e376a4.zip

.zip 128KB
4942419b35e1bd4fa2183b9b1195ff0a0c807c04d74591f05fea4cae87e376a4

.dll 260KB

4942419b35e1bd4fa2183b9b1195ff0a0c807c04d74591f05fea4cae87e376a4.zip

SHA256 c3c458aeae0d4a8a9fd7a595b4581b2772e947db68a829afeb93711b6e250faf
MD5 f2799baf71d3544ae4d0219498b4bc41
SHA1 c40eddd11d7b7de260c24e05e933435208f91b42
SHA512 ffc9b3ee7c27cfa1dcc66f034b1592972887dd5ad9031cbe97f91cfe0008924a9ad2ea92b0959848d5060e2987a2b4d88e6fb406a6b02385b26f9609a9a4f2cc
SSDEEP 3072:pTI8+mSX74sDts09ThqHHMinzLGGlK19pMG+881a72/i2:pTI8+/vDbGsq/lKgal2
TLSH
T176D3124A518D71BB9EEF217CE49831B7C260BDC2505F5F82DA6458A80B09BED373C84B
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

4942419b35e1bd4fa2183b9b1195ff0a0c807c04d74591f05fea4cae87e376a4

IMPHASH e060daefaf7ff6c7401014aa587bc143
SHA256 4942419b35e1bd4fa2183b9b1195ff0a0c807c04d74591f05fea4cae87e376a4
MD5 42e57fd291fe6b47bacda52966a42f80
SHA1 3da2fc2a4c796d79927118a14ba481f8bd702742
SHA512 dd9ec408bec8335028cac8b989677b6742a4f4832c10a3a77e481fc762b2caf534a67ae32f625d6d61a2ea56d374f2a427aa60ad87d5a0c2a9ecdf8980473413
SSDEEP 6144:uJqVG5d1IpMyibgkTZI6jHID90aLBXJH/:u3d6tevoxbBXF
TLSH
T158445B4932A47CF9E8A7D63AC657461BEFF27C564730D70F0364069A0F237A1A22D762
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

118272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

VirtualProtectEx TerminateProcess ReadProcessMemory WriteProcessMemory GetThreadContext ResumeThread CreateProcessA GetCurrentDirectoryW GetFullPathNameA GetLogicalDrives FindClose SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExpandEnvironmentStringsA GetFileAttributesA FindFirstFileA FindNextFileA CopyFileA MoveFileA OpenProcess GetCurrentProcessId VirtualAllocEx CreateThread OpenThread CreateToolhelp32Snapshot Thread32First Thread32Next CreateRemoteThread SetThreadContext VirtualProtect MapViewOfFile UnmapViewOfFile CreateFileMappingA Wow64GetThreadContext Wow64SetThreadContext SetLastError SetNamedPipeHandleState PeekNamedPipe CreateFileA WaitNamedPipeA GetModuleFileNameA GetComputerNameA GetVersionExA GetACP GetOEMCP HeapAlloc CreateNamedPipeA GetProcessHeap InitializeProcThreadAttributeList DeleteProcThreadAttributeList SetErrorMode UpdateProcThreadAttribute DuplicateHandle ProcessIdToSessionId Process32First Process32Next VirtualQuery ExitProcess ExitThread ConnectNamedPipe ReadFile GetCurrentThread GetCurrentProcess MultiByteToWideChar GetCurrentDirectoryA SetCurrentDirectoryA GetStartupInfoA DisconnectNamedPipe CreatePipe GetTickCount GetLocalTime CloseHandle FlushFileBuffers WriteFile WaitForSingleObject GetLastError Sleep GetModuleHandleA RaiseException SetEnvironmentVariableW SetEnvironmentVariableA LoadLibraryA VirtualFree VirtualAlloc SetEndOfFile CreateFileW WriteConsoleW SetStdHandle GetStringTypeW LCMapStringW CompareStringW HeapSize LoadLibraryW OutputDebugStringW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter RemoveDirectoryW CreateDirectoryW DeleteFileW GetFileType SetFilePointerEx SetFilePointer ReadConsoleW GetConsoleMode GetConsoleCP WideCharToMultiByte GetCPInfo GetProcAddress HeapFree FreeLibrary EncodePointer DecodePointer GetModuleHandleExW AreFileApisANSI GetSystemTimeAsFileTime HeapReAlloc GetCommandLineA GetCurrentThreadId GetStdHandle GetModuleFileNameW IsDebuggerPresent IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW LoadLibraryExW RtlUnwindEx IsValidCodePage

advapi32

GetTokenInformation OpenProcessToken CryptReleaseContext CryptAcquireContextA CryptGenRandom CheckTokenMembership DuplicateTokenEx LogonUserA LookupAccountSidA FreeSid AllocateAndInitializeSid ImpersonateNamedPipeClient RevertToSelf GetUserNameA CreateProcessWithTokenW CreateProcessWithLogonW CreateProcessAsUserA ImpersonateLoggedOnUser LookupPrivilegeValueA AdjustTokenPrivileges OpenThreadToken

wininet

InternetReadFile InternetCloseHandle InternetConnectA InternetQueryDataAvailable InternetQueryOptionA InternetSetOptionA InternetSetStatusCallback HttpOpenRequestA HttpAddRequestHeadersA HttpSendRequestA HttpQueryInfoA InternetOpenA

ws2_32

send connect WSASocketA WSAIoctl socket WSAStartup closesocket ntohl htons htonl gethostbyname ntohs ioctlsocket recv shutdown WSAGetLastError __WSAFDIsSet accept bind listen select WSACleanup