cobaltstrike | dab66b936cec922efb1d2c8f9d35ae1391b472ce64e8b8b8e8e213d785cdeef5

Resubmissions

14/08/2026, 04:18

260814-ewxd6avshv10

14/08/2026, 03:56

260814-ehpgdsck4y10

Sharing

Copy URL Twitter E-mail

General

Target
dab66b936cec922efb1d2c8f9d35ae1391b472ce64e8b8b8e8e213d785cdeef5
Size 10.4MB
Sample260814-ehpgdsck4y
SHA256 dab66b936cec922efb1d2c8f9d35ae1391b472ce64e8b8b8e8e213d785cdeef5
MD5 3bccbfadae84a02a070f14f51cb77d8d
SHA1 bbd7272ba929bdfb327419d1c54065602f1c3f36
SHA512 5b0f6992acd055029ce6b19908147f060c044c2544e5dc06e381370661bdbfb39d21eb5fee089a2d9f355bdaaf6bcecda414a79eab8982ba9afae5474331ce34
SSDEEP 196608:GTf24qRJECAYBPv2zq/tqjacT1+rNNBykKp2FHLS2MUg+OaY5DULYir8SS5vz:GTf24azBPIHzT1+rNy0HLS2MUg+OTpUY
TLSH
T11AB63324DB1CCA0AF8D52C76E739CFE7E4A420FB4952583AE83142F779B2B95871411E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

391144938

http://osce12-0-sc.url.asiainfo-sec.com:443/dist/css/bootstrap.min.css

Attributes

access_type
512
beacon_type
2048
host
osce12-0-sc.url.asiainfo-sec.com,/dist/css/bootstrap.min.css
http_header1
AAAACgAAADhBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sOwAAABAAAAAWSG9zdDogZ2V0Ym9vdHN0cmFwLmNvbQAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAACgAAAB9BY2NlcHQtTGFuZ3VhZ2U6IHpoLUNOLHpoO3E9MC45AAAABwAAAAAAAAANAAAAAgAAAAlfX2NmZHVpZD0AAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAADhBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sOwAAABAAAAAWSG9zdDogZ2V0Ym9vdHN0cmFwLmNvbQAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAACgAAAB9BY2NlcHQtTGFuZ3VhZ2U6IHpoLUNOLHpoO3E9MC45AAAABwAAAAAAAAANAAAABQAAAAVzZXJ2ZQAAAAcAAAABAAAAAwAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
POST
http_method2
POST
jitter
9472
polling_time
10000
port_number
443
sc_process32
%windir%\syswow64\svchost.exe -k netsvcs
sc_process64
%windir%\sysnative\svchost.exe -k netsvcs
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCYHK/0x3rcyqtMXnhlsxXiY2vZpm/QWLhUNR7hXkdeBmQnOqRYB7coUvHbr87d1p4RJ1d+KsoEyXPOKduJTvguqUJ08u0uNvYf2PXFvYYfyunDj+Apci0yEnIklW2BCYY2BYhCh5i53iFFW26qthTzrgYcfpx/pJbU0DpK3dK4AQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
3.462927616e+09
unknown2
AAAABAAAAAEAAAAtAAAAAQAABsMAAAACAAAAFAAAAAIAAAA1AAAAAgAAACwAAAACAAAAJAAAAAIAAABLAAAAAgAAC6IAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/dist/js/bootstrap.bundle.min.js
user_agent
Mozilla/5.0 (X11; U; Linux x86_64; en-us) AppleWebKit/531.2+ (KHTML, like Gecko) Version/5.0 Safari/531.2+
watermark
391144938

Targets

- Target
  Q3_2026081017001/Q3_2026081017001.lnk
- Size 618B
- SHA256 ac791befcd13c94d81a51d57f3f9d8cefbe554a2e0b24f3cb0704cfb4b215a1a
- MD5 a2f6c36bd658552d20fa8c229b5d1922
- SHA1 4be20007738fe61a0cf438fa72187cf09f59bfa4
- SHA512 fbed06f805c83cb1d49fff562d59483241701a35dfd08d776d6bf0c3f0c0be5e0e7ab3b563b85df2baec89df2b9fa3bdf49f6d6bceb8a058f55c83f48d538f29
- TLSH
  T18AF0ED2CAEC71B3AD640C235EC776300C93A38A6F6A50F6E40844B8410B72012688E2F
- MD5 SHA1 SHA512 TLSH
Score

10^/10

backdoor 391144938 discovery execution cobaltstrike trojan
- Family: Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  Q3_2026081017001/helper/helper.exe
- Size 1.2MB
- SHA256 a2a54b8abc476d7671d4de0771bb54bf5f2373d79ff6871d0ba6a62c3b88ae00
- MD5 52086b801555ef17e4b51e0acffc70b3
- SHA1 cfd57e014de125db717d1381506ab857fcb7ebd1
- SHA512 ff154875bb6deff3e17d0efd9e814eda8208ed6dfbb424ab3ad349ba84086cd8023df96cc689d90823a0a48fe96d8e75958f4dd990af7399e521a9eab0b446d3
- SSDEEP 24576:A2ctIvKqwpMKvT7QvYMy91tA2DP2crkmQNHElqKlRRaBs:lToMKvPQvOi8AmQNsrlLa
- TLSH
  T12D459E0773E7C1E9DE7BC1F9C9614226EB31B8640B389ADB2590452EDF63AD04E3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor 391144938 discovery execution cobaltstrike trojan
- Family: Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral3 behavioral4
- Target
  Q3_2026081017001/helper/helper.js
- Size 368KB
- SHA256 b76f68bde02bb11322c093f80b770f88d6690abe409e6044a297b91a6c59b75f
- MD5 0278a067e29673a3944fe34d1a13cfd9
- SHA1 ccc9defd693bbc345fd80a54d81561bd8d69ec3b
- SHA512 ace810f30901efc645662996b48b2742270ad7c83462e3afc9dcc0448ef19cf875a1eb7ab837e9af74df16263155dc1d52bc28fd603dd8fabf84f205ad4952ee
- SSDEEP 6144:hzOZIYRr9YpiYXDRx8c3lGKEz6E8korQFnw7Y0ynAbiadrKtLSe0MBpdbnGC+ydr:hzEHYgex8c9JE8kqQ9v3+TrCP976EOsn
- TLSH
  T1AC842390D89D4E6E0EF1807EB9BFCC6E09800B7886DCF660F4449E6764DE759016FA72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Q3_2026081017001/helper/node.exe
- Size 24.1MB
- SHA256 3f7871c38eaf02b7d5867ac3ac9a9da451510e48fd1cd1e574a95b03804ddddd
- MD5 02219a83685c628070e1e794b2539d18
- SHA1 bee33e7f63e5e6d3f680c02c86a515147d7d6ee6
- SHA512 124946a288d68d6f350a5f26b04135d47fec8f6715f02369661f54c0f7603e2ddbe3197df5efb69e62307fd3f4ac5db5bfd3bfebefb803ad0b2c631fee8084ae
- SSDEEP 196608:3P87PllM4t7oYD7frxAjvAR2iC7xY3BVX9c2cDX6O9lupkGqWqnxVD+Jbc:3P8+YndKvAR2xx6R9YFlKhqWcxpoQ
- TLSH
  T161478D03BA8301A2E9B3537504BB13379737AA128731C5CBB25C2A556F736D0563BBE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Family: Cobaltstrike

Badlisted process makes network request

Checks computer location settings

Family: Cobaltstrike

Badlisted process makes network request

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8