cobaltstrike | 4281710c131daf5452a2a981f9a1081d448e4524fc0f9a7a3519323d8f192f0c

General

Target
427ab14634f3ce8770b1695aecf64b4d65f4651e8bebe2dee1cdce5ccbad57ea.zip
Size 112KB
Sample261023-vt8bmscy5v
SHA256 4281710c131daf5452a2a981f9a1081d448e4524fc0f9a7a3519323d8f192f0c
MD5 299495ca8a096723a90c15083b3f21bc
SHA1 2c4db481a75e141506e6665c9ec3e28a1722a14a
SHA512 18e1c5b4680c799d68fcfd8d9b13580bf92162d81b5b72b46de83e30e048afc3410a85fb189888ea3a694a8b3a8ff9e15d42728c770b6ff7bf1e3d1150987696
SSDEEP 3072:wSLv+0WAvSjbsJ+jEvguuzGBbIsFuwUaHYI:nWNjbscuuzKzF6aH5
TLSH
T126B312A61C75E8C71F9D99BB6A3F441434B08BB3C23723CA6D8E1749F4EDC20E5520A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

1101518270

Attributes

access_type
512
host
10.10.0.1
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
polling_time
60000
port_number
80
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD0RiqMywHp9+fXHLNiYDDdDA21d+bNjoHnKHyvNsLrPAIenupyO08LeNWzYd5+huwWFGNFP60bxZzMoBjpvz4/IXlhwCU1InR8z21sSLkgIPBgZoeXDXRHIzZHffaahuQym0/ekwFHuPPYgmkX8ba675dQYhnRIujw/RCOpMiewQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0; BOIE9;ENUS)
watermark
1101518270

Targets

- Target
  427ab14634f3ce8770b1695aecf64b4d65f4651e8bebe2dee1cdce5ccbad57ea
- Size 204KB
- SHA256 427ab14634f3ce8770b1695aecf64b4d65f4651e8bebe2dee1cdce5ccbad57ea
- MD5 6cb31b7e988327a620db3f1d5bafbd3c
- SHA1 529804b2caaf72e89a1bfcf1a27d545428fe858f
- SHA512 ed3aac955f2b722f88cf3d2ea94a136da39d0e985701b437eff0f10a2dd91517cc3a8013f168c4e06fa018e717e463865dd86e79a7e212e20df08b0694696d5f
- SSDEEP 3072:5dFna2JSkcrnYSdM50RAXSPy0qUiS0Lxh5H4evyzUhjQUE5j:FRYkcrY4MCIt07iPlvU0j
- TLSH
  T1D4147B9175C1F036D05B0439634BCB724FBDFD3816B19987BB984A9A9E71393DB2A203
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2