cobaltstrike | ae85ddfa2a5d7b55d5842ceb64d04a108ece01ef8b8c2186a270cd9de5c85284

General

Target
2d8f0bfbda3919647d74fe67c6ffd6c25e3203fc02098a9b2d5033bece068893.zip
Size 113KB
Sample261024-mftx4aa17q
SHA256 ae85ddfa2a5d7b55d5842ceb64d04a108ece01ef8b8c2186a270cd9de5c85284
MD5 62089d4ab5d47a19ff72f0f6842d2040
SHA1 c012cd5b658b76afb144c476c38977738ee61b43
SHA512 671208a9dae98e7f8c8c9ee1f0cae253ec9e2bea45bc2f6e2b55d5d67b73431bb34a891cddea882e313e49682144d8fae1b0a7d45eea94e492d66c2cd1e565d2
SSDEEP 3072:ZkHcjUOCiKp0vvZHPNyCrFaPn0OP1gbFi6GAv2JE:ZLWpqhBac01gbY61QE
TLSH
T183B312860B39622E1BCC16BBF9FB5144770E1E2677428B37DA4E39498D7BC84CD72A11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

0

C2

http://update.microsoft-support.net:80/comment-reply.min.js

Attributes

access_type
512
crypto_scheme
256
host
update.microsoft-support.net
http_header1
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAVSG9zdDogY29kZS5qcXVlcnkuY29tAAAACgAAACBSZWZlcmVyOiBodHRwOi8vY29kZS5qcXVlcnkuY29tLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAANAAAAAgAAAAlfX2NmZHVpZD0AAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAVSG9zdDogY29kZS5qcXVlcnkuY29tAAAACgAAACBSZWZlcmVyOiBodHRwOi8vY29kZS5qcXVlcnkuY29tLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAAPAAAADQAAAAUAAAAIX19jZmR1aWQAAAAHAAAAAQAAAA8AAAANAAAABAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
jitter
9472
maxdns
255
pipe_name
\\%s\pipe\mojo.5688.8052.183894939787088877%x
polling_time
120000
port_number
80
sc_process32
%windir%\syswow64\svchost.exe -k netsvcs
sc_process64
%windir%\sysnative\svchost.exe -k netsvcs
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCJk8CPb58xTRj5ByaM1fQKqQtOpcfbRfELf0L4HxN33PaLU9w9FCaxOQUjiDk16D2AB5vHDWFKkX4j38Tgp+lsGGewJ+QCndJyKXRj/tz4KRisXXAJ1IdJGd3RvbE0HXHMn5630RMXULATw1uJbsQhe1X4nkCxv0NTvB/NarajkwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4.234810624e+09
unknown2
AAAABAAAAAEAAAXyAAAAAgAAAFQAAAACAAAPWwAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/jquery-ui.min.js
user_agent
Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Targets

- Target
  2d8f0bfbda3919647d74fe67c6ffd6c25e3203fc02098a9b2d5033bece068893
- Size 206KB
- SHA256 2d8f0bfbda3919647d74fe67c6ffd6c25e3203fc02098a9b2d5033bece068893
- MD5 27134f6b64c199093f2128e1243769c5
- SHA1 8a10512ea54c82b3318acd38b7a3b9c8e72d9d42
- SHA512 404433c756bae7bdf0971827b7fa4019b6aaef8ad68ffdebc5297c54246e384030d557b3e156bc8d7d6d82c095e3ae2708e2b580693783919305a17dd37e9591
- SSDEEP 3072:cxYXMJJciFoSYMoXYQlwfv/gF8jua3PX4Ns5drwolUtaF0XL5DuN:cuXkiq4wfv4Kjnv+srwoRaK
- TLSH
  T170248CA07091E036D05B0438620BCB7E5BFDF9F41271A487BBD85A5AAE71393EB19347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2