General
- Target 2026-10-19_1b776a70d47a3eccbde2866537232bb4_amadey_cobalt-strike_coinminer_smoke-loader
- Size 239KB
- Sample261021-c1ghdscs3m
- SHA256 d73785f9e037d1f7fa780c5a9f8e2abee5d66f9c2853321892333132230f34c4
- MD5 1b776a70d47a3eccbde2866537232bb4
- SHA1 9a46f050b712763d7f99fdd5be66f57d1676176c
- SHA512 f12d0e3d315256a850f8bf3504cb63b6555358446ffcc75d0b6935e6f2cdb974f989cdb8e30709433ae7695106acbacc0d9dbbc2916e7dff7e5312333cc12aad
- SSDEEP 6144:7vw1Vx8EnOkQoHanErBBpe2BQcmDtM1hpjbLL5kx6uq:7v60ExFXrBe8ItuhpjtkxDq
- TLSH T1C7349E913895F872D05A0478634BCB734EBDBC341671A6C7ABC41E9A8F326D3D72A207
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
cobaltstrike
Botnet
-
987654321
C2
-
http://ns1.waveheart.online:53/api/v1/telemetry
Attributes
-
access_type
512
-
beacon_type
256
-
dns_idle
6.737204e+07
-
host
ns1.waveheart.online
-
http_method1
GET
-
http_method2
POST
-
maxdns
225
-
polling_time
10000
-
port_number
53
-
sc_process32
%windir%\syswow64\wbem\wmiprvse.exe
-
sc_process64
%programfiles(x86)%\microsoft\edge\application\msedge.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCew3HE5fAmi/iUbEFz7f7VWVylXMVFIeP2ZRUXIXzPvQnJ6Ngt7XFXDIvYEj2nyxLnHwSDhzYbVHNHdKYIcm0cJeID8VkF7eAv/ETldfb3jb9u4vv3BY0mUmc3QrvfAmqriUBB9iA9NXRBCC5+2A8KPTVkGIAVT5uFLl4D4btAjQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
3.128704512e+09
-
watermark
987654321