cobaltstrike | 1ecfdd5553dca3005a3772aabdade560598400a58496d5a957d0944c73e77e32

General

Target
df54bf18bfaae0bafce6731ed7349464f5a1013bc0e78ea81083394c385f7898.zip
Size 113KB
Sample261021-p4ejesft9p
SHA256 1ecfdd5553dca3005a3772aabdade560598400a58496d5a957d0944c73e77e32
MD5 55744da253f6e29213379bd85e7bfc92
SHA1 a62d8f6235c8f542868f6a383b9319bf09d80ec0
SHA512 04b95a23e4444ce477d1182e36c6cc3a88231f6db1b9e851206e8ff700449b22d6ca705a3b3772c6a101d2c4295e9e818df3aed2788852200b783b41917c4b92
SSDEEP 3072:hknC2x+6/CSwcgZixn+rOhk4PtI1+xkfdD:qCePasgy+qhXtwGkd
TLSH
T1C7B312E79771FBCF9F15C9ED21398481792D89870347EE688E3AB8959C4778930F2980
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

0

C2

http://104.194.85.251:443/jquery-3.3.1.min.js

Attributes

access_type
512
beacon_type
2048
crypto_scheme
256
host
104.194.85.251
http_header1
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAVSG9zdDogY29kZS5qcXVlcnkuY29tAAAACgAAACBSZWZlcmVyOiBodHRwOi8vY29kZS5qcXVlcnkuY29tLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAANAAAAAgAAAAlfX2NmZHVpZD0AAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAVSG9zdDogY29kZS5qcXVlcnkuY29tAAAACgAAACBSZWZlcmVyOiBodHRwOi8vY29kZS5qcXVlcnkuY29tLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAAPAAAADQAAAAUAAAAIX19jZmR1aWQAAAAHAAAAAQAAAA8AAAANAAAABAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
jitter
9472
maxdns
255
pipe_name
\\%s\pipe\mojo.5688.8052.183894939787088877%x
polling_time
60000
port_number
443
sc_process32
%windir%\syswow64\svchost.exe -k netsvcs
sc_process64
%windir%\sysnative\svchost.exe -k netsvcs
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC2ZN2OkRcN9iiXThYHmEZZ29wOBAVO1EbecTX7ZWS2EOXXx5gJZ3yqEUNs5hZoS5cHs/Pugy5eQtHosbDm1XDS4PjIN8dfFnVlHtB1NoPpTEucnrgDKFVtgf7txDcqgdWTDrhXc8s0YrH2Q01QnZG3SrsbuwWw8kVAp47SlcgTDwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4.234810624e+09
unknown2
AAAABAAAAAEAAAXyAAAAAgAAAFQAAAACAAAPWwAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/jquery-3.3.2.min.js
user_agent
Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
watermark
0

Targets

- Target
  df54bf18bfaae0bafce6731ed7349464f5a1013bc0e78ea81083394c385f7898
- Size 206KB
- SHA256 df54bf18bfaae0bafce6731ed7349464f5a1013bc0e78ea81083394c385f7898
- MD5 7ae2728ab043d595ae79a41566189ea7
- SHA1 cc60598ea2fd8896618e4fee3f03f3269f5d187b
- SHA512 49f9722243aa99513c762ce05de844c3e380006653f622a79047c96e784351090e3a00ae90c2cf51fff6ed817c78365b93ddcdc830e50625c9e2960dcec14923
- SSDEEP 3072:cxYXMJJciFoSYMoXYQlwfv/gF8jua3PX4Ns5drwolUtq0L50uN:cuXkiq4wfv4Kjnv+srwof0d
- TLSH
  T1AF248CA07181E032D05B0439621BCB7E5BFDF9F41271A447BBD81A5AAE71393EB29347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2