cobaltstrike | 4d27b500f0e7ac544ac4f4dcd32d2a0a9b9be8111f21b6eb9ba229b631b8e6b7

General

Target
4d27b500f0e7ac544ac4f4dcd32d2a0a9b9be8111f21b6eb9ba229b631b8e6b7
Size 4.6MB
Sample261002-d6p76avvcv
SHA256 4d27b500f0e7ac544ac4f4dcd32d2a0a9b9be8111f21b6eb9ba229b631b8e6b7
MD5 659f3d43de71263b8a424eee5541b407
SHA1 377768010f5e4fbc2b1b2f3f8c6d08e5aa02a9ed
SHA512 b43f19c04e7a44d96dcd0399235d131c5c49ceaa46fee861025b7b05305001dd847504e677da14110d3d2130d68e59783063a57714025583676f4bea6f30d76e
SSDEEP 49152:OuZC3FJrb/TWvO90dL3BmAFd4A64nsfJ+WNq3v3MVkOHx3bEnnkY3Xw4g9MUth7:5C3F0uKUrwUZ0
TLSH
T15026BE326852F9F9DB9E283044102D465D787C4B1B7053CBAB44B6BE36BA6D04E3D7B8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

cobaltstrike 0 backdoor discovery execution trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

0

C2

http://124.221.206.154:1443/submit.php

Attributes

access_type
512
beacon_type
2048
host
124.221.206.154
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAANzaWQAAAAHAAAAAQAAAAMAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
1443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCnOM3nXx+7HBhkbDd+AwFrFisSunK999w2tM0uTpuuEiBalcJhcL+QgQWtf6S7zPp5hjImG+2YcPl18geU4f5JlSPXHwilbK4DFb/ePWyKFjhrA7emVRqhM21QMlo1ANsn14rY/RO2pzuft8P7TXoIjjI/B2GGVuzYNZX6X4I2EwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.jsp
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; NP09; NP09; MAAU)
watermark
0

Targets

- Target
  4d27b500f0e7ac544ac4f4dcd32d2a0a9b9be8111f21b6eb9ba229b631b8e6b7
- Size 4.6MB
- SHA256 4d27b500f0e7ac544ac4f4dcd32d2a0a9b9be8111f21b6eb9ba229b631b8e6b7
- MD5 659f3d43de71263b8a424eee5541b407
- SHA1 377768010f5e4fbc2b1b2f3f8c6d08e5aa02a9ed
- SHA512 b43f19c04e7a44d96dcd0399235d131c5c49ceaa46fee861025b7b05305001dd847504e677da14110d3d2130d68e59783063a57714025583676f4bea6f30d76e
- SSDEEP 49152:OuZC3FJrb/TWvO90dL3BmAFd4A64nsfJ+WNq3v3MVkOHx3bEnnkY3Xw4g9MUth7:5C3F0uKUrwUZ0
- TLSH
  T15026BE326852F9F9DB9E283044102D465D787C4B1B7053CBAB44B6BE36BA6D04E3D7B8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor 0 discovery execution cobaltstrike trojan
- Family: Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2