cobaltstrike | 4bea807397343baf45d9a9b4c1742ca626a48212dfa858cb4a6d41eb1088a30b

General

Target
4bea807397343baf45d9a9b4c1742ca626a48212dfa858cb4a6d41eb1088a30b
Size 19KB
Sample261011-kxa57seh97
SHA256 4bea807397343baf45d9a9b4c1742ca626a48212dfa858cb4a6d41eb1088a30b
MD5 4e268cd5b9c8d3ef3c411123a728c826
SHA1 a1f98c8e452a062a237f48480b4cb78d2aa11a6e
SHA512 caf2c72e2ff5aaf1d5845adeee2ec85c04a4bbf2963f6dd44c0a4a5549673f8dbeb773e87100814aacd4ca0dc36cf30a08a0e71ec6cd9265f37a72a16a2dd793
SSDEEP 192:LV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2suret7wyyYoWF8qa1Dojjgi:lqaCF31cix+Dc4zjaretzvdFF46gi
TLSH
T1E492C93FE71368E9C106D5B845FB3733DCB23DB385A6972E2724D1B42E106A46E6E910
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

C2

http://123.57.9.205:61111/hKu5

Attributes

user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727)

Extracted

Family

cobaltstrike

Botnet

987654321

C2

http://123.57.9.205:61111/dot.gif

Attributes

access_type
512
host
123.57.9.205
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
61111
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCcDDwm8IUaQ3o9ekzWJTysXaaEBREvbkxKAYyS2PP/tHge3hjNeUSO597c0AwecTmnMif4RlG1Hzw0D0LbTMGRV7heMwPFxMsA0ROQchemVT2jBiR813U0rkdSAWePYj/UueqY5xy83Nb90WEPxGSBSftoDxZSp9dcNLhUpiEjYwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) LBBROWSER
watermark
987654321

Targets

- Target
  4bea807397343baf45d9a9b4c1742ca626a48212dfa858cb4a6d41eb1088a30b
- Size 19KB
- SHA256 4bea807397343baf45d9a9b4c1742ca626a48212dfa858cb4a6d41eb1088a30b
- MD5 4e268cd5b9c8d3ef3c411123a728c826
- SHA1 a1f98c8e452a062a237f48480b4cb78d2aa11a6e
- SHA512 caf2c72e2ff5aaf1d5845adeee2ec85c04a4bbf2963f6dd44c0a4a5549673f8dbeb773e87100814aacd4ca0dc36cf30a08a0e71ec6cd9265f37a72a16a2dd793
- SSDEEP 192:LV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2suret7wyyYoWF8qa1Dojjgi:lqaCF31cix+Dc4zjaretzvdFF46gi
- TLSH
  T1E492C93FE71368E9C106D5B845FB3733DCB23DB385A6972E2724D1B42E106A46E6E910
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor 987654321 cobaltstrike trojan discovery
- Family: Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Family: Cobaltstrike

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2