cobaltstrike | 2ea6233f89dd33e8961063031231a1f92e80b59dd577050cad2a066d68443522[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
2ea6233f89dd33e8961063031231a1f92e80b59dd577050cad2a066d68443522.zip
Size 113KB
Sample261024-mfl79atwcx
SHA256 ad2cb5188110d19ad348db23cbd8375b425434ec909440c731dd1fe8c7ccba41
MD5 a7ee0ab7b74d0c5b83a229025b2ae812
SHA1 4d03815176719e091b007563540bb5283142112c
SHA512 38399de23aa196d5cb6fc67f0091eb2f40a9f94c68fad1f6f19a964267d8f0004a0375efc077747ad244250cac4b0623396e3abebd8d29e447c8e5a1f4aa2247
SSDEEP 3072:eWFGyWD64lANSsErQDk9zlY6bv3bJsW6/eRVVkov5d:eWF7Wm4lASTrQDk9vvmwRVOoxd
TLSH
T134B312ECC453D1AD892BCA17F3348758586F42457E1CC201A0B7D9ABF666EB0E50BE0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

0 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://172.96.238.154:80/jquery-3.3.1.min.js

Attributes

access_type
512
crypto_scheme
256
host
172.96.238.154
http_header1
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAVSG9zdDogY29kZS5qcXVlcnkuY29tAAAACgAAACBSZWZlcmVyOiBodHRwOi8vY29kZS5qcXVlcnkuY29tLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAANAAAAAgAAAAlfX2NmZHVpZD0AAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAVSG9zdDogY29kZS5qcXVlcnkuY29tAAAACgAAACBSZWZlcmVyOiBodHRwOi8vY29kZS5qcXVlcnkuY29tLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAAPAAAADQAAAAUAAAAIX19jZmR1aWQAAAAHAAAAAQAAAA8AAAANAAAABAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
jitter
9472
maxdns
255
pipe_name
\\%s\pipe\mojo.5688.8052.183894939787088877%x
polling_time
60000
port_number
80
sc_process32
%windir%\syswow64\svchost.exe -k netsvcs
sc_process64
%windir%\sysnative\svchost.exe -k netsvcs
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCayh8dSm2v1hD666CTr0xhPImdBRVKIORw2aJhA7vfIbXG3VfoP7eNS2BxUTDThC69GlhBudewCHZrz6XCtiqKt/ztnQZlpBa10Y4UxOqNGnPwN4tOcFyasYaSCh6F3Dzg4capvtkwaOYgLovy3vb9RGciEH4GbyKVoCDZrxB6JQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4.234810624e+09
unknown2
AAAABAAAAAEAAAXyAAAAAgAAAFQAAAACAAAPWwAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/jquery-3.3.2.min.js
user_agent
Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2ea6233f89dd33e8961063031231a1f92e80b59dd577050cad2a066d68443522

File Explorer

2ea6233f89dd33e8961063031231a1f92e80b59dd577050cad2a066d68443522.zip

.zip 113KB
2ea6233f89dd33e8961063031231a1f92e80b59dd577050cad2a066d68443522

.dll 206KB

2ea6233f89dd33e8961063031231a1f92e80b59dd577050cad2a066d68443522.zip

SHA256 ad2cb5188110d19ad348db23cbd8375b425434ec909440c731dd1fe8c7ccba41
MD5 a7ee0ab7b74d0c5b83a229025b2ae812
SHA1 4d03815176719e091b007563540bb5283142112c
SHA512 38399de23aa196d5cb6fc67f0091eb2f40a9f94c68fad1f6f19a964267d8f0004a0375efc077747ad244250cac4b0623396e3abebd8d29e447c8e5a1f4aa2247
SSDEEP 3072:eWFGyWD64lANSsErQDk9zlY6bv3bJsW6/eRVVkov5d:eWF7Wm4lASTrQDk9vvmwRVOoxd
TLSH
T134B312ECC453D1AD892BCA17F3348758586F42457E1CC201A0B7D9ABF666EB0E50BE0D
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

2ea6233f89dd33e8961063031231a1f92e80b59dd577050cad2a066d68443522

IMPHASH 0bc418575efc832b308d227b31192688
SHA256 2ea6233f89dd33e8961063031231a1f92e80b59dd577050cad2a066d68443522
MD5 225231848e08c2b87a4a19aff1bce193
SHA1 e3759dcc60012cd4cacf095f87a5b6f6d761137d
SHA512 9513eb9a2349aeade7e5f9faa5bbcaf20faaafccea0913d291ec80e41f0ba0358fcc55312af164cf63ba7efecf0a73811082dc36f275e4749652ed2602f75b6a
SSDEEP 3072:cxYXMJJciFoSYMoXYQlwfv/gF8jua3PX4Ns5drwolUtu1L5JuN:cuXkiq4wfv4Kjnv+srwo71g
TLSH
T17A248CA07181E032D05B0439621BCB7E5BFDF9F41271A447BBD81A5AAE71393EB29347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

650688

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_SYSTEM IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

UpdateProcThreadAttribute HeapFree GetProcessHeap CreateRemoteThread VirtualAlloc VirtualProtectEx VirtualAllocEx LoadLibraryA ProcessIdToSessionId DuplicateHandle InitializeProcThreadAttributeList WriteProcessMemory CreateThread GetThreadContext SetThreadContext FreeLibrary VirtualFree Thread32First Thread32Next SetLastError OpenThread CreateToolhelp32Snapshot GetVersionExA SuspendThread ResumeThread PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState LocalAlloc LocalFree GetComputerNameA Process32First TerminateProcess HeapAlloc ExitProcess DeleteProcThreadAttributeList VirtualProtect FindNextFileA MoveFileA FindClose CopyFileA FindFirstFileA FileTimeToSystemTime GetFileAttributesA ExpandEnvironmentStringsA GetLogicalDrives SystemTimeToTzSpecificLocalTime GetFullPathNameA GetModuleHandleA CreateNamedPipeA GetProcAddress ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetFileTime GetCurrentDirectoryA CreatePipe GetCurrentDirectoryW GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe MultiByteToWideChar CreateProcessA OpenProcess WriteFile SetFileTime WaitForSingleObject SetEnvironmentVariableW CreateFileA Sleep SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA VirtualQuery GetModuleFileNameW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoA HeapSize IsValidCodePage GetCPInfo DebugBreak RaiseException QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetCurrentProcessId GetOEMCP GetLocalTime GetACP Process32Next GetTickCount GetEnvironmentStrings FreeEnvironmentStringsA SetFilePointer GetFileType GetModuleHandleW DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount RtlUnwind WideCharToMultiByte GetConsoleCP GetConsoleMode SetHandleCount

advapi32

RegEnumValueA CloseServiceHandle OpenProcessToken CreateProcessWithLogonW DeleteService CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx LookupAccountSidA GetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCloseKey RegEnumKeyA CreateProcessAsUserA RegOpenCurrentUser RegOpenKeyExA GetUserNameA AdjustTokenPrivileges ControlService QueryServiceStatusEx ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA OpenThreadToken OpenServiceA OpenSCManagerA QueryServiceStatus CreateProcessWithTokenW StartServiceA CreateServiceA

wininet

HttpQueryInfoA InternetQueryDataAvailable InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetOpenA InternetCloseHandle InternetQueryOptionA InternetConnectA

ws2_32

ntohs connect htons socket accept send gethostname inet_ntoa WSAStartup WSACleanup gethostbyname htonl ntohl listen __WSAFDIsSet bind recv shutdown WSAGetLastError select ioctlsocket inet_addr closesocket

dnsapi

DnsFree DnsQuery_A

iphlpapi

GetIfEntry GetIpAddrTable

secur32

LsaCallAuthenticationPackage LsaConnectUntrusted LsaLookupAuthenticationPackage