cobaltstrike | 07c6bb6542aea19d0a8f7a3d2c0ea86ddc58fd3a43e54f22d7f7a0b67d8a372b

General

Target
07c6bb6542aea19d0a8f7a3d2c0ea86ddc58fd3a43e54f22d7f7a0b67d8a372b
Size 316KB
Sample260905-q4y4hasxhs
SHA256 07c6bb6542aea19d0a8f7a3d2c0ea86ddc58fd3a43e54f22d7f7a0b67d8a372b
MD5 f12da00fced6c9589c9154f6184c94dc
SHA1 348c362dcf5ba986201e6ddd342df837ebbe8fe2
SHA512 7873e7a8a29f2b0220eea297ef71168fb280d942580fba400bab7443239f2d00d5dd4f3ac1b328d417f79ec41ba0b2601ac1ef17c1370332ef840562e07bfd9c
SSDEEP 3072:rqr6IGh+6rPPTL69FJ69xt02QExUJFm/P1EVFI0j43xfn62hX/s2CrUsgd3domav:rqMY6r04BuJAlEU3B9kthgDr4vG/0
TLSH
T1E664CF189E660FBEC3A00FF58886EA0E953061B7D0752F559561A084D82D8FB3A73DF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

987654321

C2

http://wikiieaks.org:8000/pixel

Attributes

access_type
512
host
wikiieaks.org
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
month
3.3554432e+07
polling_time
60000
port_number
8000
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCCbA+aLP+t7vsa+YNBAqzknFJ8Kw/mjp6wdWugdXijzMnHqG0bxHyBmihPtNoN/TkF9qUGTsKaQ8lHMNMGIIgNDp3fu6XbGn9X/8kL+m2Tjz9XFzGLxBJev+h4vsB/uUSAPo6aIaRIP2UdUABBvfZApr97QFd0SHdZ8KEIcsmvTwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
watermark
987654321

Targets

- Target
  07c6bb6542aea19d0a8f7a3d2c0ea86ddc58fd3a43e54f22d7f7a0b67d8a372b
- Size 316KB
- SHA256 07c6bb6542aea19d0a8f7a3d2c0ea86ddc58fd3a43e54f22d7f7a0b67d8a372b
- MD5 f12da00fced6c9589c9154f6184c94dc
- SHA1 348c362dcf5ba986201e6ddd342df837ebbe8fe2
- SHA512 7873e7a8a29f2b0220eea297ef71168fb280d942580fba400bab7443239f2d00d5dd4f3ac1b328d417f79ec41ba0b2601ac1ef17c1370332ef840562e07bfd9c
- SSDEEP 3072:rqr6IGh+6rPPTL69FJ69xt02QExUJFm/P1EVFI0j43xfn62hX/s2CrUsgd3domav:rqMY6r04BuJAlEU3B9kthgDr4vG/0
- TLSH
  T1E664CF189E660FBEC3A00FF58886EA0E953061B7D0752F559561A084D82D8FB3A73DF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor 987654321 discovery cobaltstrike trojan
- Family: Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Cobaltstrike

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2