cobaltstrike | c6f032908faf09fa26398e5b42c28ad47d2fe2fe92c8a6f663e676b4ef428fb0

General

Target
c6f032908faf09fa26398e5b42c28ad47d2fe2fe92c8a6f663e676b4ef428fb0
Size 3.6MB
Sample260916-x95a2adc22
SHA256 c6f032908faf09fa26398e5b42c28ad47d2fe2fe92c8a6f663e676b4ef428fb0
MD5 52097049963f0707555cae6b3cc8609b
SHA1 8075390bcf9ecd74efd398b9b66aea066911fee2
SHA512 454d1dbca5e92a47a6f855442f9d5eb19476eeb69dff24734d5149d729cc720251b35d46b0810f8448af85881afa57b7d67f84281e20d60e1e5e37ea64a3b9c7
SSDEEP 49152:nV2QKqnYj7QN9CFWKFRSWt7o0QJsRpLeKSePqAphO9:n8QLq+
TLSH
T1B806BF57FCA2B865C1AE66364866E46B7A617C040F7213DBAB90B37C1B76FC01B39314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

987654321

C2

http://8.137.117.105:9999/ga.js

Attributes

access_type
512
host
8.137.117.105
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
9999
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCgfaJgQclfqXgEsGW+iP0xqsKtOnMJvvtFScMqFRbMWs77n1b9ydOOTveWIDhoUaufILywcb2sPt6vCb/79c+dYH8kVxxgwHM9w98EF5F2/iWeZCz2vcNeyOo1IswH6zeolljdRSIGU7yIPBRcfXUsQPqwKZX0lpRuGXkLUR/u+QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MALC)
watermark
987654321

Targets

- Target
  c6f032908faf09fa26398e5b42c28ad47d2fe2fe92c8a6f663e676b4ef428fb0
- Size 3.6MB
- SHA256 c6f032908faf09fa26398e5b42c28ad47d2fe2fe92c8a6f663e676b4ef428fb0
- MD5 52097049963f0707555cae6b3cc8609b
- SHA1 8075390bcf9ecd74efd398b9b66aea066911fee2
- SHA512 454d1dbca5e92a47a6f855442f9d5eb19476eeb69dff24734d5149d729cc720251b35d46b0810f8448af85881afa57b7d67f84281e20d60e1e5e37ea64a3b9c7
- SSDEEP 49152:nV2QKqnYj7QN9CFWKFRSWt7o0QJsRpLeKSePqAphO9:n8QLq+
- TLSH
  T1B806BF57FCA2B865C1AE66364866E46B7A617C040F7213DBAB90B37C1B76FC01B39314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor 987654321 cobaltstrike persistence trojan
- Family: Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2