cobaltstrike | df54bf18bfaae0bafce6731ed7349464f5a1013bc0e78ea81083394c385f7898[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
df54bf18bfaae0bafce6731ed7349464f5a1013bc0e78ea81083394c385f7898.zip
Size 113KB
Sample261021-p4ejesft9p
SHA256 1ecfdd5553dca3005a3772aabdade560598400a58496d5a957d0944c73e77e32
MD5 55744da253f6e29213379bd85e7bfc92
SHA1 a62d8f6235c8f542868f6a383b9319bf09d80ec0
SHA512 04b95a23e4444ce477d1182e36c6cc3a88231f6db1b9e851206e8ff700449b22d6ca705a3b3772c6a101d2c4295e9e818df3aed2788852200b783b41917c4b92
SSDEEP 3072:hknC2x+6/CSwcgZixn+rOhk4PtI1+xkfdD:qCePasgy+qhXtwGkd
TLSH
T1C7B312E79771FBCF9F15C9ED21398481792D89870347EE688E3AB8959C4778930F2980
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

0 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://104.194.85.251:443/jquery-3.3.1.min.js

Attributes

access_type
512
beacon_type
2048
crypto_scheme
256
host
104.194.85.251
http_header1
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAVSG9zdDogY29kZS5qcXVlcnkuY29tAAAACgAAACBSZWZlcmVyOiBodHRwOi8vY29kZS5qcXVlcnkuY29tLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAANAAAAAgAAAAlfX2NmZHVpZD0AAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAVSG9zdDogY29kZS5qcXVlcnkuY29tAAAACgAAACBSZWZlcmVyOiBodHRwOi8vY29kZS5qcXVlcnkuY29tLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAAPAAAADQAAAAUAAAAIX19jZmR1aWQAAAAHAAAAAQAAAA8AAAANAAAABAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
jitter
9472
maxdns
255
pipe_name
\\%s\pipe\mojo.5688.8052.183894939787088877%x
polling_time
60000
port_number
443
sc_process32
%windir%\syswow64\svchost.exe -k netsvcs
sc_process64
%windir%\sysnative\svchost.exe -k netsvcs
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC2ZN2OkRcN9iiXThYHmEZZ29wOBAVO1EbecTX7ZWS2EOXXx5gJZ3yqEUNs5hZoS5cHs/Pugy5eQtHosbDm1XDS4PjIN8dfFnVlHtB1NoPpTEucnrgDKFVtgf7txDcqgdWTDrhXc8s0YrH2Q01QnZG3SrsbuwWw8kVAp47SlcgTDwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4.234810624e+09
unknown2
AAAABAAAAAEAAAXyAAAAAgAAAFQAAAACAAAPWwAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/jquery-3.3.2.min.js
user_agent
Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/df54bf18bfaae0bafce6731ed7349464f5a1013bc0e78ea81083394c385f7898

File Explorer

df54bf18bfaae0bafce6731ed7349464f5a1013bc0e78ea81083394c385f7898.zip

.zip 113KB
df54bf18bfaae0bafce6731ed7349464f5a1013bc0e78ea81083394c385f7898

.dll 206KB

df54bf18bfaae0bafce6731ed7349464f5a1013bc0e78ea81083394c385f7898.zip

SHA256 1ecfdd5553dca3005a3772aabdade560598400a58496d5a957d0944c73e77e32
MD5 55744da253f6e29213379bd85e7bfc92
SHA1 a62d8f6235c8f542868f6a383b9319bf09d80ec0
SHA512 04b95a23e4444ce477d1182e36c6cc3a88231f6db1b9e851206e8ff700449b22d6ca705a3b3772c6a101d2c4295e9e818df3aed2788852200b783b41917c4b92
SSDEEP 3072:hknC2x+6/CSwcgZixn+rOhk4PtI1+xkfdD:qCePasgy+qhXtwGkd
TLSH
T1C7B312E79771FBCF9F15C9ED21398481792D89870347EE688E3AB8959C4778930F2980
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

df54bf18bfaae0bafce6731ed7349464f5a1013bc0e78ea81083394c385f7898

IMPHASH 0bc418575efc832b308d227b31192688
SHA256 df54bf18bfaae0bafce6731ed7349464f5a1013bc0e78ea81083394c385f7898
MD5 7ae2728ab043d595ae79a41566189ea7
SHA1 cc60598ea2fd8896618e4fee3f03f3269f5d187b
SHA512 49f9722243aa99513c762ce05de844c3e380006653f622a79047c96e784351090e3a00ae90c2cf51fff6ed817c78365b93ddcdc830e50625c9e2960dcec14923
SSDEEP 3072:cxYXMJJciFoSYMoXYQlwfv/gF8jua3PX4Ns5drwolUtq0L50uN:cuXkiq4wfv4Kjnv+srwof0d
TLSH
T1AF248CA07181E032D05B0439621BCB7E5BFDF9F41271A447BBD81A5AAE71393EB29347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

650688

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_SYSTEM IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

UpdateProcThreadAttribute HeapFree GetProcessHeap CreateRemoteThread VirtualAlloc VirtualProtectEx VirtualAllocEx LoadLibraryA ProcessIdToSessionId DuplicateHandle InitializeProcThreadAttributeList WriteProcessMemory CreateThread GetThreadContext SetThreadContext FreeLibrary VirtualFree Thread32First Thread32Next SetLastError OpenThread CreateToolhelp32Snapshot GetVersionExA SuspendThread ResumeThread PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState LocalAlloc LocalFree GetComputerNameA Process32First TerminateProcess HeapAlloc ExitProcess DeleteProcThreadAttributeList VirtualProtect FindNextFileA MoveFileA FindClose CopyFileA FindFirstFileA FileTimeToSystemTime GetFileAttributesA ExpandEnvironmentStringsA GetLogicalDrives SystemTimeToTzSpecificLocalTime GetFullPathNameA GetModuleHandleA CreateNamedPipeA GetProcAddress ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetFileTime GetCurrentDirectoryA CreatePipe GetCurrentDirectoryW GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe MultiByteToWideChar CreateProcessA OpenProcess WriteFile SetFileTime WaitForSingleObject SetEnvironmentVariableW CreateFileA Sleep SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA VirtualQuery GetModuleFileNameW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoA HeapSize IsValidCodePage GetCPInfo DebugBreak RaiseException QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetCurrentProcessId GetOEMCP GetLocalTime GetACP Process32Next GetTickCount GetEnvironmentStrings FreeEnvironmentStringsA SetFilePointer GetFileType GetModuleHandleW DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount RtlUnwind WideCharToMultiByte GetConsoleCP GetConsoleMode SetHandleCount

advapi32

RegEnumValueA CloseServiceHandle OpenProcessToken CreateProcessWithLogonW DeleteService CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx LookupAccountSidA GetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCloseKey RegEnumKeyA CreateProcessAsUserA RegOpenCurrentUser RegOpenKeyExA GetUserNameA AdjustTokenPrivileges ControlService QueryServiceStatusEx ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA OpenThreadToken OpenServiceA OpenSCManagerA QueryServiceStatus CreateProcessWithTokenW StartServiceA CreateServiceA

wininet

HttpQueryInfoA InternetQueryDataAvailable InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetOpenA InternetCloseHandle InternetQueryOptionA InternetConnectA

ws2_32

ntohs connect htons socket accept send gethostname inet_ntoa WSAStartup WSACleanup gethostbyname htonl ntohl listen __WSAFDIsSet bind recv shutdown WSAGetLastError select ioctlsocket inet_addr closesocket

dnsapi

DnsFree DnsQuery_A

iphlpapi

GetIfEntry GetIpAddrTable

secur32

LsaCallAuthenticationPackage LsaConnectUntrusted LsaLookupAuthenticationPackage