cobaltstrike | a4ae8bfc9052772d90ae972ade7d28e1a4b862a5023f0edfc1b1d1527da83ddc

General

Target
21ec01054c1c52ac1b12785896903c745d7173b2b8b99165348d5dda6670e62b.zip
Size 127KB
Sample260822-13phsavvf1
SHA256 a4ae8bfc9052772d90ae972ade7d28e1a4b862a5023f0edfc1b1d1527da83ddc
MD5 df6a4e1dccbc175424189e2e001f2534
SHA1 493ec7b962ee7417c011cf4f00448c02ae7e7345
SHA512 d7495744d4ba09362fb9c9d7aa5f3b348195cc14b606054ca2aafb175557b9e37cc35b248dc32b000e7ee3abab63cb5ee72c95be559a91e0a93100ee32e10f23
SSDEEP 3072:sKnHY3NlkgvcOSiubVGs1+lT6M/L4y7mXL+cPVFnGKrNRT5+J5:JHklkwczRQ2MjDmaqvnLbY
TLSH
T142D312282F0DD0A9D6A8CF8709F4F68B5477E45684B2460F1CA02F68B0237B9BD8D9C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

2111195880

C2

http://ns1.zf-electronic.de:53/ptj

Attributes

access_type
512
beacon_type
256
host
ns1.zf-electronic.de,/ptj
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
polling_time
60000
port_number
53
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCh4Q+tqylyDabozt8RXxy0JuEr7kb+LnAkrazCNJsdIkBgnN0zrJGwZKDBIRbhMLNoSx0R897XnB85kLruuKMqsiIB0EnVMzbJqJK2dzh1Vu9VtFesvfbwgCfm/+FH6FXEGKSOwXyBKSGhS/2LM3Lkj7mo0/EZbilEOxclt3UclQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; Touch)
watermark
2111195880

Targets

- Target
  21ec01054c1c52ac1b12785896903c745d7173b2b8b99165348d5dda6670e62b
- Size 256KB
- SHA256 21ec01054c1c52ac1b12785896903c745d7173b2b8b99165348d5dda6670e62b
- MD5 53724bf8ba441fe9b09ec9cbbb3cb2f3
- SHA1 f7e98eb68ad015d2f15bf398b4cf026e26100b95
- SHA512 03dfdddb379d952a0cb2aca146730999744c0a28d72a4ede71d37f5d3c140722fda5d74cf67119c368e0297825a32c977fea5d682bf0fa05ae765107d91b3b34
- SSDEEP 3072:v+nWuxYWAPoTYb5mLY0A5YjhI0dJ+HglT2pdk+jt998cV5ftAYJolXQyIZ:v+nNWc7A5YjhIqjTAKSn98cLFApiZ
- TLSH
  T1F0445B4932E43CB9ECA7D779CA97461ADFF27C654630D71F03640A9A0F173A1A22E352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2