cobaltstrike | d22e35c7c7ed6a030016ca2fdddecdba2598b149769ef23b0a6f7808309f15f6[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
d22e35c7c7ed6a030016ca2fdddecdba2598b149769ef23b0a6f7808309f15f6.zip
Size 108KB
Sample260823-cmp8da1hrf
SHA256 676287ebf9daf368ff51c3a855e4fd3e6e92e9dd489e799a39ffc617bb4c2aed
MD5 fce04f95dd7fe156d550b86befb3c5d4
SHA1 ccdadbce0283190f527ee54a9ca1fec866846012
SHA512 2403d356d0e53ce36c085d38a11fff83ccb9761d2adbdb887d7c8e532a21f967bf67c7be5540a8936deeb0459ded5a5dd9b625f90a1150c6ee586b3cba07cae3
SSDEEP 3072:bub00RhByM2YoxiKmwRhl7V/tMMpeT2mYB:bN0pyML2iKTRV/tz8ymi
TLSH
T197B3121CBE60DE29E30D6E65DAABD5CC111680A80FFB3655BCEB504932F31C2066C7DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

0 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://185.166.239.49:443/activity

Attributes

access_type
512
beacon_type
2048
create_remote_thread
768
host
185.166.239.49,/activity
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
60000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC+0gOsgQwvv+6zENgJXANvbxyZpKsDjUUpFoD06yDdGXYAbQIaZTLlQ5up7zmTdOTLzKA8H1EgEnX8SflaZ6VUjrm/jBFTnKbSg6NJbYFt7AUAdXU7bkNwg2pfVWpMaQBh1skBR6z9J1rb6PdE+BCUZ0wPM7uYT6PVjHdGANrUowIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0; BOIE9;ENUS)
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/d22e35c7c7ed6a030016ca2fdddecdba2598b149769ef23b0a6f7808309f15f6

File Explorer

d22e35c7c7ed6a030016ca2fdddecdba2598b149769ef23b0a6f7808309f15f6.zip

.zip 108KB
d22e35c7c7ed6a030016ca2fdddecdba2598b149769ef23b0a6f7808309f15f6

.dll 204KB

d22e35c7c7ed6a030016ca2fdddecdba2598b149769ef23b0a6f7808309f15f6.zip

SHA256 676287ebf9daf368ff51c3a855e4fd3e6e92e9dd489e799a39ffc617bb4c2aed
MD5 fce04f95dd7fe156d550b86befb3c5d4
SHA1 ccdadbce0283190f527ee54a9ca1fec866846012
SHA512 2403d356d0e53ce36c085d38a11fff83ccb9761d2adbdb887d7c8e532a21f967bf67c7be5540a8936deeb0459ded5a5dd9b625f90a1150c6ee586b3cba07cae3
SSDEEP 3072:bub00RhByM2YoxiKmwRhl7V/tMMpeT2mYB:bN0pyML2iKTRV/tz8ymi
TLSH
T197B3121CBE60DE29E30D6E65DAABD5CC111680A80FFB3655BCEB504932F31C2066C7DA
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

d22e35c7c7ed6a030016ca2fdddecdba2598b149769ef23b0a6f7808309f15f6

IMPHASH f2e0b7b9a08bd8dcaf133d9278ecdb47
SHA256 d22e35c7c7ed6a030016ca2fdddecdba2598b149769ef23b0a6f7808309f15f6
MD5 b1019d788fd20111ea3bc4c4d1e12440
SHA1 51131a8dac94614975213dcfe57d8c7093b08135
SHA512 fee4a05413ef05f634e898d3cb91ec481c4697e2d3dacc3540c436aa47ec29fe63a991eab2058cc9ccbb4c651df41e66e2ab4835fee9e01f872e29f8ada2426d
SSDEEP 3072:Pjh9N4a1j712h9Td2+1lxvTeZna8xUhUbT15B:PjdFKdoSxvixTxUA
TLSH
T1D2248DA131C4D036D0570479624BC77E5EBDFDF416B19487BF841AA69E71393EB2A203
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

94033

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

MoveFileA FindNextFileA DeleteProcThreadAttributeList HeapAlloc UpdateProcThreadAttribute HeapFree GetProcessHeap CreateRemoteThread VirtualAlloc VirtualProtectEx VirtualAllocEx ProcessIdToSessionId VirtualProtect DuplicateHandle InitializeProcThreadAttributeList WriteProcessMemory GetThreadContext SetThreadContext FreeLibrary VirtualFree Thread32First Thread32Next SetLastError LoadLibraryA OpenThread CreateToolhelp32Snapshot SuspendThread ResumeThread PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState LocalAlloc LocalFree GetComputerNameA FindClose TerminateProcess Process32Next CopyFileA FindFirstFileA FileTimeToSystemTime GetFileAttributesA ExpandEnvironmentStringsA GetLogicalDrives SystemTimeToTzSpecificLocalTime GetFullPathNameA CreateThread GetVersionExA GetModuleHandleA CreateNamedPipeA GetProcAddress ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetFileTime GetCurrentDirectoryA CreatePipe GetCurrentDirectoryW GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe GetEnvironmentVariableA CreateProcessA OpenProcess WriteFile SetFileTime WaitForSingleObject SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile SetEnvironmentVariableW VirtualQuery GetModuleFileNameW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA HeapSize DebugBreak RaiseException QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA CreateFileA GetCurrentProcessId GetLocalTime Sleep Process32First GetTickCount SetFilePointer GetFileType SetHandleCount GetConsoleMode GetModuleHandleW ExitProcess MultiByteToWideChar DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind WideCharToMultiByte GetConsoleCP

advapi32

GetUserNameA CloseServiceHandle OpenProcessToken CreateProcessWithLogonW DeleteService CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx LookupAccountSidA GetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserA AdjustTokenPrivileges ControlService QueryServiceStatusEx ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA OpenThreadToken OpenServiceA OpenSCManagerA QueryServiceStatus CreateProcessWithTokenW StartServiceA CreateServiceA

wininet

HttpQueryInfoA InternetConnectA InternetQueryDataAvailable InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetQueryOptionA InternetOpenA

ws2_32

ntohs connect htons socket accept send gethostname inet_ntoa WSAStartup WSACleanup gethostbyname htonl ntohl listen __WSAFDIsSet bind recv shutdown WSAGetLastError select ioctlsocket inet_addr closesocket

dnsapi

DnsFree DnsQuery_A

iphlpapi

GetIfEntry GetIpAddrTable

secur32

LsaCallAuthenticationPackage LsaConnectUntrusted LsaLookupAuthenticationPackage