cobaltstrike | 676287ebf9daf368ff51c3a855e4fd3e6e92e9dd489e799a39ffc617bb4c2aed

General

Target
d22e35c7c7ed6a030016ca2fdddecdba2598b149769ef23b0a6f7808309f15f6.zip
Size 108KB
Sample260823-cmp8da1hrf
SHA256 676287ebf9daf368ff51c3a855e4fd3e6e92e9dd489e799a39ffc617bb4c2aed
MD5 fce04f95dd7fe156d550b86befb3c5d4
SHA1 ccdadbce0283190f527ee54a9ca1fec866846012
SHA512 2403d356d0e53ce36c085d38a11fff83ccb9761d2adbdb887d7c8e532a21f967bf67c7be5540a8936deeb0459ded5a5dd9b625f90a1150c6ee586b3cba07cae3
SSDEEP 3072:bub00RhByM2YoxiKmwRhl7V/tMMpeT2mYB:bN0pyML2iKTRV/tz8ymi
TLSH
T197B3121CBE60DE29E30D6E65DAABD5CC111680A80FFB3655BCEB504932F31C2066C7DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

0

C2

http://185.166.239.49:443/activity

Attributes

access_type
512
beacon_type
2048
create_remote_thread
768
host
185.166.239.49,/activity
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
60000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC+0gOsgQwvv+6zENgJXANvbxyZpKsDjUUpFoD06yDdGXYAbQIaZTLlQ5up7zmTdOTLzKA8H1EgEnX8SflaZ6VUjrm/jBFTnKbSg6NJbYFt7AUAdXU7bkNwg2pfVWpMaQBh1skBR6z9J1rb6PdE+BCUZ0wPM7uYT6PVjHdGANrUowIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0; BOIE9;ENUS)
watermark
0

Targets

- Target
  d22e35c7c7ed6a030016ca2fdddecdba2598b149769ef23b0a6f7808309f15f6
- Size 204KB
- SHA256 d22e35c7c7ed6a030016ca2fdddecdba2598b149769ef23b0a6f7808309f15f6
- MD5 b1019d788fd20111ea3bc4c4d1e12440
- SHA1 51131a8dac94614975213dcfe57d8c7093b08135
- SHA512 fee4a05413ef05f634e898d3cb91ec481c4697e2d3dacc3540c436aa47ec29fe63a991eab2058cc9ccbb4c651df41e66e2ab4835fee9e01f872e29f8ada2426d
- SSDEEP 3072:Pjh9N4a1j712h9Td2+1lxvTeZna8xUhUbT15B:PjdFKdoSxvixTxUA
- TLSH
  T1D2248DA131C4D036D0570479624BC77E5EBDFDF416B19487BF841AA69E71393EB2A203
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2