cobaltstrike | 45a2b6524a902ed38fb984b5c46a2a86ef63baaf88a816942ea9e9a59f8a52d3

General

Target
45a2b6524a902ed38fb984b5c46a2a86ef63baaf88a816942ea9e9a59f8a52d3
Size 204KB
Sample260727-kn28bsy1fs
SHA256 45a2b6524a902ed38fb984b5c46a2a86ef63baaf88a816942ea9e9a59f8a52d3
MD5 39f42953724cc455997d3247e00b3214
SHA1 d450da082e0fb4882654b28922f0ac782bc1f09b
SHA512 4b9937786a27e7e9328f9a2c0c599168c3aa6664b3ad95c4655dda8e5cd58cae3d55f8023a1a5327ab3d40ad582c676959b0b381ba69a015b6344c3304ba3b10
SSDEEP 3072:9dFna2JSkcrnYSdM50RAXSPy0qUiS0Lxh5H4evyzUhjQUxE:BRYkcrY4MCIt07iPlvU0j
TLSH
T1F1148C5135C1F036E05B0439624BCB724FFDFE3516B0A887AF995AA69E31392D72A307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

cobaltstrike 0 305419896 adware backdoor discovery persistence ransomware spyware trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

305419896

C2

http://ns.vvwvv.tk:443/jquery-3.3.1.min.js

Attributes

access_type
512
beacon_type
2048
dns_idle
1.908702538e+09
host
ns.vvwvv.tk,/jquery-3.3.1.min.js
http_header1
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAgUmVmZXJlcjogaHR0cDovL2NvZGUuanF1ZXJ5LmNvbS8AAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADQAAAAIAAAAJX19jZmR1aWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAgUmVmZXJlcjogaHR0cDovL2NvZGUuanF1ZXJ5LmNvbS8AAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADwAAAA0AAAAFAAAACF9fY2ZkdWlkAAAABwAAAAEAAAAPAAAADQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
jitter
9472
maxdns
255
polling_time
45000
port_number
443
sc_process32
%windir%\syswow64\dllhost.exe
sc_process64
%windir%\sysnative\dllhost.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCBxT+Kl4ZGNagywNBHKTgABsjKwz63g/eZUEo1u45flFykpbhIwqL1AprSoua9EtS7RW0f9y9mMem7yVyTgdNoAtXOHAgIYIseranOQazjd8AzrwJOBMJSzAng0IaRsvGGzsG0wItt29OogQmQa19gCauUs8onCt7i2eN5CCtD4QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4.234810624e+09
unknown2
AAAABAAAAAEAAAXyAAAAAgAAAFQAAAACAAAPWwAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/jquery-3.3.2.min.js
user_agent
Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
watermark
305419896

Extracted

Family

cobaltstrike

Botnet

0

Attributes

watermark
0

Targets

- Target
  45a2b6524a902ed38fb984b5c46a2a86ef63baaf88a816942ea9e9a59f8a52d3
- Size 204KB
- SHA256 45a2b6524a902ed38fb984b5c46a2a86ef63baaf88a816942ea9e9a59f8a52d3
- MD5 39f42953724cc455997d3247e00b3214
- SHA1 d450da082e0fb4882654b28922f0ac782bc1f09b
- SHA512 4b9937786a27e7e9328f9a2c0c599168c3aa6664b3ad95c4655dda8e5cd58cae3d55f8023a1a5327ab3d40ad582c676959b0b381ba69a015b6344c3304ba3b10
- SSDEEP 3072:9dFna2JSkcrnYSdM50RAXSPy0qUiS0Lxh5H4evyzUhjQUxE:BRYkcrY4MCIt07iPlvU0j
- TLSH
  T1F1148C5135C1F036E05B0439624BCB724FFDFE3516B0A887AF995AA69E31392D72A307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor 0 discovery cobaltstrike trojan adware persistence ransomware spyware
- Family: Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2