cobaltstrike | 5c63677ceaa808bca9666d8a79789d037fcf5430e9d111ef0a96cb5ad167fb0f

General

Target
1155fb2fe1738d806068761f086427c6fe910830fdc74d44873bc0db757b0bda.zip
Size 115KB
Sample261019-rk34saav3j
SHA256 5c63677ceaa808bca9666d8a79789d037fcf5430e9d111ef0a96cb5ad167fb0f
MD5 13c3cf32c39c4c3ab2a3245984d0b8f7
SHA1 84ae9955d226e47dc97daca6c796578da629dde0
SHA512 0d7830b0d7442fe2b2fd7ac5c0c39552e7272dc1a7ef73e0ff6d7ede7c39300a93b80ca41cacf06e05410ffa7ba1b1d2139503406955dd68485046793c05f7bd
SSDEEP 3072:HTxmjsqZ4SSUJG/4CDfv828n4L7Fd5xyie/:NespSS3Zs+Fd/N6
TLSH
T1D4B312801C4EA78432735E3C89591275A63F2CE24478EDADB26C98D94F63163F1F5DCA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

1873433027

Attributes

access_type
512
beacon_type
256
host
192.168.10.55
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
polling_time
60000
port_number
25
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCv1p5p7sHDi3TcMGZJOWYEOex96KBgvuH8/TsmQHq6GZG7h8rVffEpd4YpFKviuTZPt5UMMmLZ2D0W+PJ99zQEBshUeK+4B4jAiPBbEq7a6nqPybkWBVg3UmpI08T48JIWGNXK53qic58TgmjiLU9MEWdmrgA6AJik43OY1lTYkwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Trident/6.0)
watermark
1873433027

Targets

- Target
  1155fb2fe1738d806068761f086427c6fe910830fdc74d44873bc0db757b0bda
- Size 208KB
- SHA256 1155fb2fe1738d806068761f086427c6fe910830fdc74d44873bc0db757b0bda
- MD5 0fc6d837d758591eea7923b6855d2cee
- SHA1 b2959894241b5ca2fb96a50a191e5a542f1ddee9
- SHA512 3bb6f8dca8d66a41652e96d8d7f58dde32af403df3a4c45a8d9048b333091883ac4c598a3bebc4aa18911102dedf6fc417dd4c8174b139ad2d76255505f935f2
- SSDEEP 3072:z+FcIvEbJvYdGVWwk4Kj6olpR2B5f4dS/L4jjZUO5Vw6E:AHEbJAZwBqplpAX/LmjVbE
- TLSH
  T151249D953181D532D05A0034664FC77E8BBDB8F01571D987BFD84AAA9E722D3DB2A307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2