cobaltstrike | b86071bcd22df1b13614b7247465282a468c402779a3f2b9ae19374bfb7ea0c6

General

Target
22998001c0790db3f4ba74a848b28c194b80ba2a11f6d0629c683f755948f9cb.zip
Size 120KB
Sample261005-ejj83asgjf
SHA256 b86071bcd22df1b13614b7247465282a468c402779a3f2b9ae19374bfb7ea0c6
MD5 0bc969693eb13480d05fda4a980bd4e0
SHA1 9112f60330ddf7e5c204474faae83e985d5a1ffc
SHA512 0cfb7c7cf4f674d35b9a1eb045b0b7ec535fc1709076b06cad0aa71ceb1a557a250a4e3b90c758715719e78d64a85aa9400b5970e76667a2aa5966d43f1204ac
SSDEEP 3072:2cpE7QHrgsGteXsdm3H2ScT3SLbvaoPfHz7ZAtEUXigH+PKK:2YnEsLXsd+H2JGLbvaQfp4Va
TLSH
T1F2C3125B788961B1B327DE1FD88B8C4EAD901E324FF5F2115ABF30C0B17CE99684951A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

305419896

C2

http://119.3.141.162:443/ca

Attributes

access_type
512
beacon_type
2048
host
119.3.141.162
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
polling_time
60000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCTS0cMG/xXkKf8FArxAtIuT7p+RAOC7TUoE4F9B9Z4/nfV9SS2Q5R69fZqL48rRJ0Da6M2MhOYcwZN756nyujQhKvl4fy3kXNx58nQYGwdD/veJSBGD2sD4UHtQUIecGtaNk7fH7f5qpvgnOhXOLZXKDKyOgxEnpjfG51OyAUhTQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
watermark
305419896

Targets

- Target
  22998001c0790db3f4ba74a848b28c194b80ba2a11f6d0629c683f755948f9cb
- Size 352KB
- SHA256 22998001c0790db3f4ba74a848b28c194b80ba2a11f6d0629c683f755948f9cb
- MD5 571870328310a93080ad52c3e717eb7a
- SHA1 123c3ff621177d49755c16f7a61e6e946b513a16
- SHA512 20708078cbe4c5039ae1b8ab40ec310424788a43f9ed8570fd223d891f512984c335748821e2468a44c1f40cee1aa102b9e7430cb6abe3452b3c5cdc7287f98c
- SSDEEP 3072:wdFna2JSkcrnYSdM50RAXSPy0qUiS0Lxh5H4evyzUhjQUz58:KRYkcrY4MCIt07iPlvU0j
- TLSH
  T12574C075E932FA14C74B24393449D96F8EEB2E285CF1462EC3508F19494BBC0975F2AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor 305419896 discovery cobaltstrike trojan
- Family: Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Cobaltstrike

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2