cobaltstrike | e2a5db07061efc2b6d4581f2307fdb933dde2b7992c018eb77335f6aa098e1a6

General

Target
e2a5db07061efc2b6d4581f2307fdb933dde2b7992c018eb77335f6aa098e1a6
Size 3.8MB
Sample261003-fbav4a1y2r
SHA256 e2a5db07061efc2b6d4581f2307fdb933dde2b7992c018eb77335f6aa098e1a6
MD5 badfa9ef24e23051077d94f1c5fee853
SHA1 02529e2da1bf659461b5e04789809d30e9157456
SHA512 82a3a2dcc4843ecec0f0add5614775adb20c14c506104dbdeb8a2d4ea70efca60df69876a075b46c347587246891a417334fe9ac4d339724ebad849e7b77b223
SSDEEP 49152:PAD5mHuk0r0VnjjC4mkZMyITWt1U4yP21Qsq8VT/0+2Uw2:PJm3
TLSH
T10206CF0BBCB1A9A4C19E92364966A45B7AB27C080F7153DB6740B73C2F77BC05B3A354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

987654321

C2

http://632313373.xyz:8443/js/jquery-3.3.1.min.js

Attributes

access_type
512
beacon_type
2048
host
632313373.xyz
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAmQWNjZXB0LUxhbmd1YWdlOiB6aC1DTix6aDtxPTAuOCx6aC1UVzsAAAAHAAAAAAAAAA0AAAACAAAAMWh0dHBzOi8vd3d3Lmdvb2dsZS5jb20vd2hhdD9pbmRleHR5cGU9MSZfX2NmZHVpZD0AAAAGAAAAB1JlZmVyZXIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAmQWNjZXB0LUxhbmd1YWdlOiB6aC1DTix6aDtxPTAuOCx6aC1UVzsAAAAHAAAAAAAAAAMAAAACAAAAMWh0dHBzOi8vd3d3Lmdvb2dsZS5jb20vd2hhdD9pbmRleHR5cGU9MSZfX2NmZHVpZD0AAAAGAAAAB1JlZmVyZXIAAAAHAAAAAQAAAA0AAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
15360
polling_time
12000
port_number
8443
sc_process32
%windir%\syswow64\dllhost.exe
sc_process64
%windir%\sysnative\dllhost.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDi4t8tF03kCKOZTia+mI2iru5Tc99x2zJ/Iy3cPTg4XN/QjOY7/QIg2PgX1j+EqAGGCUAL85uFL7zQZ+2Jq/pOzL3Ys8cLWGZv8nyG44zRP3ATdqInUFjyVXarPpyDrPJuOuZrg7V5qsa0TZ5oMXU17oZqpIScw7DZILHUX/YDaQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4.201256192e+09
unknown2
AAAABAAAAAEAAAXyAAAAAgAAD7AAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/post
user_agent
Mozilla/5.0 (BlackBerry; U; BlackBerry 9800; en) AppleWebKit/534.1+ (KHTML, like Gecko) Version/6.0.0.337 Mobile Safari/534.1+
watermark
987654321

Targets

- Target
  e2a5db07061efc2b6d4581f2307fdb933dde2b7992c018eb77335f6aa098e1a6
- Size 3.8MB
- SHA256 e2a5db07061efc2b6d4581f2307fdb933dde2b7992c018eb77335f6aa098e1a6
- MD5 badfa9ef24e23051077d94f1c5fee853
- SHA1 02529e2da1bf659461b5e04789809d30e9157456
- SHA512 82a3a2dcc4843ecec0f0add5614775adb20c14c506104dbdeb8a2d4ea70efca60df69876a075b46c347587246891a417334fe9ac4d339724ebad849e7b77b223
- SSDEEP 49152:PAD5mHuk0r0VnjjC4mkZMyITWt1U4yP21Qsq8VT/0+2Uw2:PJm3
- TLSH
  T10206CF0BBCB1A9A4C19E92364966A45B7AB27C080F7153DB6740B73C2F77BC05B3A354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor 987654321 discovery cobaltstrike trojan
- Family: Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Cobaltstrike

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2