cobaltstrike | 98fe81d286b241499094da20d5b959df64f7bc07f1ec915b4f4db43aadbd25b5

General

Target
8f49cfeffae67b7635a7dc8bb71dbec235ec2a9e844737dde6a0faeaa168b856.zip
Size 112KB
Sample260824-2kbpmsvbpg
SHA256 98fe81d286b241499094da20d5b959df64f7bc07f1ec915b4f4db43aadbd25b5
MD5 b3dc71aa04fd90a2ff5a47c151a39bed
SHA1 8191dd7269d550fa9d0b008a0c777906a305858f
SHA512 12110b22902e813639f7a520260807bf922a4bbf6d4f77b16d22d2db1614607fb5c4caae9df71eae7e5b9b15046447e4d8e776b9dcb951230e32515e101ace66
SSDEEP 1536:AzzOdVGc0RVD8EKh+JxlhM11xxba3m2IYqp9esucdV9+lIFVrOODAlDfjUnVhk:AzlRVrKh+nlW/YqYqp9KIFsRlDfjUnVW
TLSH
T109B312F8CBA4D68E909B09A6D4F21B6742EB08F0272F6939F35539B3D8C5978805C573
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

305419896

C2

http://192.168.3.2:65534/updates.rss

Attributes

access_type
512
host
192.168.3.2,/updates.rss
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
polling_time
60000
port_number
65534
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCTUlJ7J79z/MkkV8+MsYlOvREE2hhdGNzrKPFZ10lY0K5legA+um5JxESEaC0woDgSmOGrkh1giz/aQwd6tG4mihFgpi0oIbfwu6XZbE6ghYGyu2F7+A5TifRUzvU0YLXjK78EW12XhjHx4KopMF/AtOAueGwfiI2DmXwNzrBDvwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
watermark
305419896

Targets

- Target
  8f49cfeffae67b7635a7dc8bb71dbec235ec2a9e844737dde6a0faeaa168b856
- Size 204KB
- SHA256 8f49cfeffae67b7635a7dc8bb71dbec235ec2a9e844737dde6a0faeaa168b856
- MD5 edb5aa2bed7cdd7828f58a97e36b67aa
- SHA1 eb585d6ac1c61c966b1efbb00feb2e42f402bb24
- SHA512 665b8ff86244551a9dc14c2af8579094a5384736d1502da9d387e0a80ac602d636ad0b47a6d29507732fc4c52fa04fc9c92ab1e6db018a9ff3cf67773ccfd354
- SSDEEP 3072:5dFna2JSkcrnYSdM50RAXSPy0qUiS0Lxh5H4evyzUhjQUDm5y:FRYkcrY4MCIt07iPlvU0jn
- TLSH
  T102147B9131D1F036D05B0439624BCB724FBDFD3816B19987BB984AAA9E71393D72A307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2