cobaltstrike | b7fdd959542815bbcfd1a09dfd72300aaaa6faa75fd789eeccb44358cca24a3e[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
b7fdd959542815bbcfd1a09dfd72300aaaa6faa75fd789eeccb44358cca24a3e.zip
Size 130KB
Sample260823-2a876abd69
SHA256 2195743c01149ffbe3e9a4db2b0b43d3c7813014b05bbdf16ffd3b3f450ba480
MD5 577355caf422416f671cc3c1e48018cb
SHA1 a0b42bc51b63951536aef3425f3729de188774bf
SHA512 8259c9ae8dd47cd3325154cbc9fb6adef049064f8b8b0132ac56805a371de57461c30c8270bd345a6e73625f4918c1291a32052daa4f9fc9371fdbffe3fd0fa4
SSDEEP 3072:YvNnPK8kGPIgBH4/l+H1i4foh0a6QvNC+nsS:YvNnPK8k+5BYcH1rk0aRVCg
TLSH
T14BD3131393665AFEB283F82946A7551D4C7A696B07E8F164E28DE0199F2CB4307C73F0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

1919869680 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

1919869680

http://172.20.20.11:443/ptj

Attributes

access_type
512
beacon_type
2048
host
172.20.20.11,/ptj
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCEyPXNJQbK/u7umxcUHDPuoH5yLMPkJwOVyHcaJYjI55/4yulfC6MybHA0D+lcLlAwD7SQjcAXFt6Tjia/UvaaGrPi0fYI6H7iKl7j3au6ucaOvHjzCOJ4MdxvhJF18EN1UsaiIPQ7KUfmxSrdOLJswXP4XXTw8+X2YTk3PnLugQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.1)
watermark
1919869680

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/b7fdd959542815bbcfd1a09dfd72300aaaa6faa75fd789eeccb44358cca24a3e

File Explorer

b7fdd959542815bbcfd1a09dfd72300aaaa6faa75fd789eeccb44358cca24a3e.zip

.zip 130KB
b7fdd959542815bbcfd1a09dfd72300aaaa6faa75fd789eeccb44358cca24a3e

.dll 275KB

b7fdd959542815bbcfd1a09dfd72300aaaa6faa75fd789eeccb44358cca24a3e.zip

SHA256 2195743c01149ffbe3e9a4db2b0b43d3c7813014b05bbdf16ffd3b3f450ba480
MD5 577355caf422416f671cc3c1e48018cb
SHA1 a0b42bc51b63951536aef3425f3729de188774bf
SHA512 8259c9ae8dd47cd3325154cbc9fb6adef049064f8b8b0132ac56805a371de57461c30c8270bd345a6e73625f4918c1291a32052daa4f9fc9371fdbffe3fd0fa4
SSDEEP 3072:YvNnPK8kGPIgBH4/l+H1i4foh0a6QvNC+nsS:YvNnPK8k+5BYcH1rk0aRVCg
TLSH
T14BD3131393665AFEB283F82946A7551D4C7A696B07E8F164E28DE0199F2CB4307C73F0
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

b7fdd959542815bbcfd1a09dfd72300aaaa6faa75fd789eeccb44358cca24a3e

IMPHASH 036fe63de7eb1468fd90eb5a61bcbdf8
SHA256 b7fdd959542815bbcfd1a09dfd72300aaaa6faa75fd789eeccb44358cca24a3e
MD5 2ead929d1aa53a4b0377e267723a0560
SHA1 0dc50f342269535514a7462309197d6b1008709b
SHA512 e043d600def1a9fd6c1c9710e4cc6b3facd06515ae3e64f02e3cf72a411435e38d39b0dc8fef2bcbd1df35c3e9204a8abdeedfa7121d44702688fdf660345536
SSDEEP 3072:RzbINhWl+CIbrqqEVxtfg8jtfDCJS4l9JTFyG+JteEzCnL7zSGIkfhUYJF6vzHkM:RzbUyootfDCvT4ZTXzCLRIk5UDbrKMr
TLSH
T10D545B8972A43CF5E867D739CA57461BEFF27C564670D70F03640AAA0F233A1A22D752
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

120896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetCurrentProcess GetCurrentThread ReadFile ConnectNamedPipe CreateNamedPipeA VirtualProtectEx TerminateProcess ReadProcessMemory WriteProcessMemory GetThreadContext ResumeThread CreateProcessA GetCurrentDirectoryW GetFullPathNameA GetLogicalDrives FindClose SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExpandEnvironmentStringsA GetFileAttributesA FindFirstFileA FindNextFileA CopyFileA MoveFileA OpenProcess GetCurrentProcessId VirtualAllocEx CreateThread OpenThread CreateToolhelp32Snapshot Thread32First Thread32Next CreateRemoteThread SetThreadContext Wow64GetThreadContext Wow64SetThreadContext SetLastError SetNamedPipeHandleState PeekNamedPipe CreateFileA WaitNamedPipeA GetModuleFileNameA GetComputerNameA GetVersionExA GetACP GetOEMCP GetStartupInfoA InitializeProcThreadAttributeList DeleteProcThreadAttributeList SetErrorMode UpdateProcThreadAttribute DuplicateHandle ProcessIdToSessionId Process32First Process32Next VirtualQuery ExitProcess ExitThread DisconnectNamedPipe CreatePipe GetTickCount GetLocalTime FlushFileBuffers WriteFile WaitForSingleObject Sleep GetModuleHandleA LoadLibraryA CreateFileMappingA UnmapViewOfFile MapViewOfFile CloseHandle GetLastError HeapFree HeapAlloc HeapDestroy HeapCreate RaiseException SetEnvironmentVariableW SetEnvironmentVariableA VirtualProtect VirtualFree VirtualAlloc SetEndOfFile CreateFileW WriteConsoleW SetStdHandle GetStringTypeW LCMapStringW CompareStringW HeapSize LoadLibraryW OutputDebugStringW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter RemoveDirectoryW CreateDirectoryW DeleteFileW GetFileType SetFilePointerEx SetFilePointer ReadConsoleW GetConsoleMode GetConsoleCP WideCharToMultiByte GetCPInfo IsValidCodePage RtlUnwindEx GetProcAddress GetProcessHeap FreeLibrary EncodePointer DecodePointer GetModuleHandleExW AreFileApisANSI GetSystemTimeAsFileTime HeapReAlloc GetCommandLineA GetCurrentThreadId GetStdHandle GetModuleFileNameW IsDebuggerPresent IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW LoadLibraryExW

advapi32

GetTokenInformation OpenProcessToken CryptReleaseContext CryptAcquireContextA CryptGenRandom CheckTokenMembership DuplicateTokenEx LogonUserA LookupAccountSidA FreeSid AllocateAndInitializeSid ImpersonateNamedPipeClient RevertToSelf GetUserNameA CreateProcessWithTokenW CreateProcessWithLogonW CreateProcessAsUserA ImpersonateLoggedOnUser LookupPrivilegeValueA AdjustTokenPrivileges OpenThreadToken

wininet

InternetReadFile InternetCloseHandle InternetConnectA InternetQueryDataAvailable InternetQueryOptionA InternetSetOptionA InternetSetStatusCallback HttpOpenRequestA HttpAddRequestHeadersA HttpSendRequestA HttpQueryInfoA InternetOpenA

ws2_32

ntohs gethostbyname socket send connect ioctlsocket WSAIoctl WSACleanup WSAStartup closesocket ntohl htons htonl recv shutdown WSAGetLastError __WSAFDIsSet accept bind inet_addr listen recvfrom select sendto WSASocketA