cobaltstrike | 4871954ad5f2dcfe97c542df5f2ff510c1ab27b1e91039efb29bfc1a03812301

General

Target
4871954ad5f2dcfe97c542df5f2ff510c1ab27b1e91039efb29bfc1a03812301
Size 333KB
Sample260905-qxndeseb77
SHA256 4871954ad5f2dcfe97c542df5f2ff510c1ab27b1e91039efb29bfc1a03812301
MD5 99e2d1c18965c2ad9d53f4c4a047e8d9
SHA1 34873a625d9515bdb64c2980ffd53c5d1de5e8ce
SHA512 0da1275a9399c5299f2152fc0be21573b717a047ba8af7b2582c16b41ff1d45f916715497bb2ed15c9edc53e216c8b5ecd1502adabb58d8fb251156c819721d7
SSDEEP 6144:uIaFJVhIxZWddAhR4e/44OZ8dOkQZVrHn8M30Fwu/LUV9ra9DGR/X/2mW:uXHVhRihX/44e8dOH7Dx30FwuIVFa9w8
TLSH
T174742361B27200BCC413087459B9D332E484FCAE5794E9652BFDFEBAD6B0CA9C81C764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

987654321

Attributes

access_type
512
host
10.0.0.100
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
month
3.3554432e+07
polling_time
60000
port_number
80
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDKERtqITM7qbSIuOzqOHrL8Ut084GW1CoCwtGy/bN9+pFRNMI1EW5SKO1e6tbPcvhiOod9qFiT6Dr4RNwqNsOWQske7Q86ZNDc6HNnTlFS7/jufJ+MyF9VkBz3IiJG69U/eMdc+6HX5M/JJ06oytwtrMqF5G7ktzVdDbyKKZS9KwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727)
watermark
987654321

Targets

- Target
  4871954ad5f2dcfe97c542df5f2ff510c1ab27b1e91039efb29bfc1a03812301
- Size 333KB
- SHA256 4871954ad5f2dcfe97c542df5f2ff510c1ab27b1e91039efb29bfc1a03812301
- MD5 99e2d1c18965c2ad9d53f4c4a047e8d9
- SHA1 34873a625d9515bdb64c2980ffd53c5d1de5e8ce
- SHA512 0da1275a9399c5299f2152fc0be21573b717a047ba8af7b2582c16b41ff1d45f916715497bb2ed15c9edc53e216c8b5ecd1502adabb58d8fb251156c819721d7
- SSDEEP 6144:uIaFJVhIxZWddAhR4e/44OZ8dOkQZVrHn8M30Fwu/LUV9ra9DGR/X/2mW:uXHVhRihX/44e8dOH7Dx30FwuIVFa9w8
- TLSH
  T174742361B27200BCC413087459B9D332E484FCAE5794E9652BFDFEBAD6B0CA9C81C764
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor 987654321 cobaltstrike trojan
- Family: Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Cobaltstrike

Executes dropped EXE

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2