631b466c3a9e35983fa0ef9eb9d592c8b9da18ccc267d28c91f5587736203e69

Sharing

Copy URL Twitter E-mail

General

Target
CobaltStrike.4.8.Cracked.7z
Size 61.6MB
Sample260718-dpkw4set8q
SHA256 631b466c3a9e35983fa0ef9eb9d592c8b9da18ccc267d28c91f5587736203e69
MD5 492a290753d2dcf92232b2d637a4e701
SHA1 cc9e831c4144a3af34cb6e947d723bb722843fc5
SHA512 ce7264a1c4d25f000fef1449c3f65bbeb0f4745fbd0ae29eac72c644bf2bed277b967f2f02a3d984405aaea2eba1e9e2ec20f0e388340c66784e27d445846e10
SSDEEP 1572864:KHVg4tFuimnBS7o3OCFfRGNE0sZysFu9F2r:KHBu+o3O9FsZ49FC
TLSH
T1FEE7331A09F17316EA0ECE34FB42A6A22141B3365DA57B05D3DCC28CBA86CD356DE5D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Targets

- Target
  CobaltStrike.4.8.Cracked.7z
- Size 61.6MB
- SHA256 631b466c3a9e35983fa0ef9eb9d592c8b9da18ccc267d28c91f5587736203e69
- MD5 492a290753d2dcf92232b2d637a4e701
- SHA1 cc9e831c4144a3af34cb6e947d723bb722843fc5
- SHA512 ce7264a1c4d25f000fef1449c3f65bbeb0f4745fbd0ae29eac72c644bf2bed277b967f2f02a3d984405aaea2eba1e9e2ec20f0e388340c66784e27d445846e10
- SSDEEP 1572864:KHVg4tFuimnBS7o3OCFfRGNE0sZysFu9F2r:KHBu+o3O9FsZ49FC
- TLSH
  T1FEE7331A09F17316EA0ECE34FB42A6A22141B3365DA57B05D3DCC28CBA86CD356DE5D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  CobaltStrike4.8/Client/cobaltstrike-client.cmd
- Size 173B
- SHA256 f350ab5ca2a13db470fac76f7bfe80651a0aa577c9cf05afab301bacc9761e7c
- MD5 7fcd9056d9d68e9bf0575a6a2f1f0ae8
- SHA1 729de7a8c0781d721ff5801c2a93c0fd085bdc16
- SHA512 3f9ba648f847115f818cab1402a0eacbcf1ad332e6b4b7c361f77ef5a86ce197f270a8159889d84c38f2cdf400c11004cec73cc3a43ae30b6a4dc1340b0cff9c
- TLSH
  T166C01254E268D46D55841746E1F844A0A725465E510576620645D05C4F42A8945292DA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  CobaltStrike4.8/Client/cobaltstrike-client.jar
- Size 29.1MB
- SHA256 50987b54356dbfe6348f7883e90b311b66405c692b68d247770136f9846397d4
- MD5 915a45f75fa8d9a002f316360c78bdc0
- SHA1 c4e0c69d9a6cb152f3341fbadc189ec182fac7bc
- SHA512 7cffa22c829bb5f6b7f316384f302a87dddb3c17e5d881796151ad36408750040b16687e6af6b593f5ef56f98ef38fa6e40dbe4f0ccea2473a3cb80bd9584f2d
- SSDEEP 786432:DCIVgTlnH2N7Rf9E7QG718wUnxiQFuHA0IgeTwIAc:7AFWN7mzJ8wUHuHf1eTgc
- TLSH
  T132671222D5C52832E17B823295626553BC3FC09CE08B61A935BC67EBF8B3D498F93715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  CobaltStrike4.8/Client/cobaltstrike.auth
- Size 219B
- SHA256 332f87be75cfd0074eacc9541070e2f64434296bcbf9c92a977f27453ab1e2b9
- MD5 acef7dc5d48b3cd9553cb79551a16f8d
- SHA1 0517217f04fd281b23bdd2e4c4a72c161ccae138
- SHA512 ca4c2401af63ac225b299e854de441efc8858ede9cc7577ce190b2f28f15d5d81e6f63ce652151f89ce5ac642df84ff6f1fa4322b1036b62f983505424f115ee
- TLSH
  T102D02308CC45000302C00EB0A9C430D040AC4063E002280E09A619A01F301E90341729
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  CobaltStrike4.8/Client/uHook.jar
- Size 33KB
- SHA256 fac7b0bde869c2ac157b18cbf6d6a19e7dabea8fbc5ada848f79a2980aa370e5
- MD5 0b368310a63e476a964ec7e1a973a494
- SHA1 f98d891723343694f6daf0d178bbe5203a7c3690
- SHA512 492f08f0b6671a8cdc4df5d3eef5812ce415910beb11f3cb2d28d599047d2c01398b43b9ffa6f8a40abc4e3ba9211f7405bda725aed51bff25ced8087e899bb3
- SSDEEP 384:laJ8HPc2yObAmHLKSkDdrwwDNsHl3pzCWyfuZfrCkicxAA/Q4qs/wuoBnhExg+fb:l9k2ywrvSdgRpz7tdrCkhxAD1Hv4xt7
- TLSH
  T17CF2E18D28129624DC7A3C33FB7888A07E9A175A3C171EF7C94B9D1D2249DECC65538B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  CobaltStrike4.8/Server/.DS_Store
- Size 6KB
- SHA256 7891d2025719e9e4912eb4165a224ebf377dc91ef7386dff7e5054db26a7a7d9
- MD5 ddc03ee85e3c06ec33e063e02d2f00f7
- SHA1 e04d729f244e4b1c4dbfedc30a6174b5b18f853d
- SHA512 e49a80b3083187244e9c6834c0c7106a9ca02120ef8a49cea5a3de1b02776691547295bde83c3dabfc288a40058f5f2d23641c6ab17076bd33a0c3c4ffc2ac72
- SSDEEP 6:VWBa23Rnd2cgGj+C6XkEslX/9ldlXSPnrtHP8//kIE6PulXSPnrtHP8//k:QlRnpeC9EEX/HnXw6X1E6PqXw6X
- TLSH
  T1F9C16C42970025EBD83E2B3150D30B326BAAC47062B28B4B2911126D7C273855E66EA0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  CobaltStrike4.8/Server/TeamServerImage
- Size 34.8MB
- SHA256 12785fc4a1200ba9abe7435baf69154c41d2fd05fa69fbaa89bab04a7a059460
- MD5 e43a1b63f09794f74d90a9889f7acb77
- SHA1 4ccc5fd70e083c858f24bc64cbe6945185cf2201
- SHA512 edec8de468b2cf565a62b00b824508424c6b2a8147880fc42ad204213ff04592d02c17037686a75c5302679aa19e4d735ec5390df863b77fe505f622916fb0c4
- SSDEEP 786432:9QpO/iXLEGT8c7aftleA84exGnFPB/qI:6g/kLE8uavq/
- TLSH
  T16F87330027D596F4ECEECA34589F20DDB8D4F1F495BFA51A2FCBA842E5C0E66084E275
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral13
- Target
  CobaltStrike4.8/Server/cobaltstrike.auth
- Size 219B
- SHA256 332f87be75cfd0074eacc9541070e2f64434296bcbf9c92a977f27453ab1e2b9
- MD5 acef7dc5d48b3cd9553cb79551a16f8d
- SHA1 0517217f04fd281b23bdd2e4c4a72c161ccae138
- SHA512 ca4c2401af63ac225b299e854de441efc8858ede9cc7577ce190b2f28f15d5d81e6f63ce652151f89ce5ac642df84ff6f1fa4322b1036b62f983505424f115ee
- TLSH
  T102D02308CC45000302C00EB0A9C430D040AC4063E002280E09A619A01F301E90341729
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral14 behavioral15
- Target
  CobaltStrike4.8/Server/source-common.sh
- Size 904B
- SHA256 be08c1ebe5a776b5b76b4b4d878c2324bf0d6171c62dcbf8ce1fd49e4ad60770
- MD5 3008006d127284387b827208cdeb408d
- SHA1 71e4a933db1eba354e5e5877fd7fee4cc36e00c7
- SHA512 188501e1a209c315fdd0d8227410d827bb8f3568d3485a412172fbac9c576b8d897f07ee3d97010027235965756dfdf914dad561448643d5a0317639b1cd4646
- TLSH
  T1B3112B697CA8AC30013ED462748F9441F39E4436D1DCFC39E51052A42D62CBC559E155
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  CobaltStrike4.8/Server/teamserver
- Size 1KB
- SHA256 997b1b92a2116c79d04b7f1773fe1637bcebdf89684acc0cbc59a58c5ef812e3
- MD5 a03bf0cd010919b75d4c7fbb03175a68
- SHA1 d0a2ea17ebc4af3315d8be9c97e58c249a5097c8
- SHA512 6738eb250565e9105ca5b6cb23f0e4c8dbc42010a0d8bbb1c41d0f1f4df89b1b94ff93492a45be4ba169da4f26e376cb3a83effb36e3e97ea60b799fe074358e
- TLSH
  T1D531759BF629C7352CA801D8E20972E29F5C02DB43312E6515795E1A3502D99933EDE6
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral18 behavioral19 behavioral20 behavioral21
- Target
  CobaltStrike4.8/Server/third-party/README.winvnc.txt
- Size 23KB
- SHA256 627719d254c8168c56c8fbd40c88fbb65ebe141995b8c65763103aa07e117d47
- MD5 ce44456545c3f6695f017eeca535bc0d
- SHA1 0282d03fed2054d4ff4a7b75e0f69c7c067fa823
- SHA512 8418130cf2abd030462f1d2421d61abaa5a5bf6919da93881bf6af7d2adc1407686d22db3fe16366a15dc161930076e236343458402c535037960ed29d4251d2
- SSDEEP 384:2YSJmtBx9rsarsRyk/+tEUwi5rDL676yV12rPd34ZomzM2FR+qWK7HUd3Q0LBDZ2:29JmXx9pJk/+t7FgixMFzMqf7HUd35DY
- TLSH
  T15FB2C72F374403F205C202916A4B68CAE32ED47E722B55543869D19D276BF39C3BFA99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral22 behavioral23
- Target
  CobaltStrike4.8/Server/third-party/winvnc.x64.dll
- Size 366KB
- SHA256 13feaa32e4b03ede8799e5bee6f8d54c3af715a6488ad32f6287d8f504c7078b
- MD5 bc9fd6c5621c3fa5a16489db19746112
- SHA1 6cddeac906b3b691c611178b577a9379cfeaa401
- SHA512 52278e2ed10e086cef0fc9ce459bdefd2c7cc9e7f092692365766c19eee9757301d857a3610308f97d76fc4658f37c03e0b0d09d63f93cb846c310e599c2eaa3
- SSDEEP 6144:Vsj5MHZ/yacp9dK/WT8W/WUuLdrX64ajx0HLC1UsrTAhwwU8qc2kPoV0jp7:VW5Mwacp9dKeIdezlMCusJzV0
- TLSH
  T117845C89FB6404B9D5B7C17889B3861AD372385907646BCF27A4436A7F33FD11A3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  CobaltStrike4.8/Server/third-party/winvnc.x86.dll
- Size 281KB
- SHA256 c50183eed715ec2392249e334940acf66315797a740a8fe782934352fed144c6
- MD5 719a93419dd5123b52961a076d283f21
- SHA1 835030d4709ef6a2a408d0a6d0fe59c0db228000
- SHA512 dc4b59ce5a4b8b2007049574ea65f59651669aff60fd5f44e7ddc700ec714eeb3b5c77407be56dbca536be9855eb1b4f82abac47c87712ace891c0c77357cddd
- SSDEEP 6144:D4mXEU0AU8qYWi0BtNwG2xwC9VMEHka91rVUqS:DEUhWiqqGhs1O
- TLSH
  T15854A020F540C032D5EA027689BE6B7959BD7A31076C96C3B7C41AE81E716E36B3538F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26 behavioral27

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27