cobaltstrike | 97ebf0bf2643013801c83b7fbc32212e822fec4a2a84a37988f6f11a4d967fb6

General

Target
6d47fbd65d534052b3b56a8cedf2c519a788c396de6ae7393257d63d1f27fd5d.zip
Size 112KB
Sample261017-jfayfab14t
SHA256 97ebf0bf2643013801c83b7fbc32212e822fec4a2a84a37988f6f11a4d967fb6
MD5 c63e0642773ecc21a54ea49b6f33c4f6
SHA1 fd4cb006ff7b8faf6a323597e02de9bb1fb14029
SHA512 89b0d107f8abf7687f5a08e5b1d96581faac369d52abb93ce1dec09f2dc1f599248b9dcc835a6da174ea608bbfbbe52a46c49f0f68ea3d755959eaa734e5419c
SSDEEP 3072:dAz8tu96Oke+nC//NdpasDnc5lKOo9T2VME9FZ/QDK0C72O4or:dA4t00C/VdhDnc5YO6CME9r1P7ao
TLSH
T135B312996D5AA185BF805A36A81E8F14088A7454C8666FC9C835C17B73CC7C3B163BFB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

305419896

C2

http://94.232.40.167:9338/dot.gif

Attributes

access_type
512
host
94.232.40.167
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
polling_time
60000
port_number
9338
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCvsrx1MajFB0Lntr9Q8LCjtPlOeJNk/ZX5uHHFaTtx9vdxHnI1roe44hAErcPmt4N8CSAuJhBIFZcFnxwtSo1OmyPZg2pJ5a3UBi9/dVqK3yMAJ0HZtRu2HgOcIxnKiGRJQXntGjIcCuNa3Z6QvEgQOaliL0l74RmN4CjIMNSkpQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)
watermark
305419896

Targets

- Target
  6d47fbd65d534052b3b56a8cedf2c519a788c396de6ae7393257d63d1f27fd5d
- Size 204KB
- SHA256 6d47fbd65d534052b3b56a8cedf2c519a788c396de6ae7393257d63d1f27fd5d
- MD5 00a2ec4a62c2df8b93a30c7b8d3e3921
- SHA1 69d248a3ffd05fde747a17afbeca51c7fcd5f18c
- SHA512 bd0a2d4e66ba6c83234c50742cb4c8f5992fdf276f959d56d79f2e1bdf269c08951c137f65987ce39666fbbf69dae6c47368997f83f94edd257e3e2f7bd0d706
- SSDEEP 3072:5dFna2JSkcrnYSdM50RAXSPy0qUiS0Lxh5H4evyzUhjQUQm5kzU:FRYkcrY4MCIt07iPlvU0js
- TLSH
  T1A2147B9171D0F036D0570439634BCB724FBDFD3816B19987BB984A9A9E72393D72A207
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2