cobaltstrike | 2d8f0bfbda3919647d74fe67c6ffd6c25e3203fc02098a9b2d5033bece068893[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
2d8f0bfbda3919647d74fe67c6ffd6c25e3203fc02098a9b2d5033bece068893.zip
Size 113KB
Sample261024-mftx4aa17q
SHA256 ae85ddfa2a5d7b55d5842ceb64d04a108ece01ef8b8c2186a270cd9de5c85284
MD5 62089d4ab5d47a19ff72f0f6842d2040
SHA1 c012cd5b658b76afb144c476c38977738ee61b43
SHA512 671208a9dae98e7f8c8c9ee1f0cae253ec9e2bea45bc2f6e2b55d5d67b73431bb34a891cddea882e313e49682144d8fae1b0a7d45eea94e492d66c2cd1e565d2
SSDEEP 3072:ZkHcjUOCiKp0vvZHPNyCrFaPn0OP1gbFi6GAv2JE:ZLWpqhBac01gbY61QE
TLSH
T183B312860B39622E1BCC16BBF9FB5144770E1E2677428B37DA4E39498D7BC84CD72A11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

0 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://update.microsoft-support.net:80/comment-reply.min.js

Attributes

access_type
512
crypto_scheme
256
host
update.microsoft-support.net
http_header1
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAVSG9zdDogY29kZS5qcXVlcnkuY29tAAAACgAAACBSZWZlcmVyOiBodHRwOi8vY29kZS5qcXVlcnkuY29tLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAANAAAAAgAAAAlfX2NmZHVpZD0AAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAVSG9zdDogY29kZS5qcXVlcnkuY29tAAAACgAAACBSZWZlcmVyOiBodHRwOi8vY29kZS5qcXVlcnkuY29tLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAAPAAAADQAAAAUAAAAIX19jZmR1aWQAAAAHAAAAAQAAAA8AAAANAAAABAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
jitter
9472
maxdns
255
pipe_name
\\%s\pipe\mojo.5688.8052.183894939787088877%x
polling_time
120000
port_number
80
sc_process32
%windir%\syswow64\svchost.exe -k netsvcs
sc_process64
%windir%\sysnative\svchost.exe -k netsvcs
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCJk8CPb58xTRj5ByaM1fQKqQtOpcfbRfELf0L4HxN33PaLU9w9FCaxOQUjiDk16D2AB5vHDWFKkX4j38Tgp+lsGGewJ+QCndJyKXRj/tz4KRisXXAJ1IdJGd3RvbE0HXHMn5630RMXULATw1uJbsQhe1X4nkCxv0NTvB/NarajkwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4.234810624e+09
unknown2
AAAABAAAAAEAAAXyAAAAAgAAAFQAAAACAAAPWwAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/jquery-ui.min.js
user_agent
Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2d8f0bfbda3919647d74fe67c6ffd6c25e3203fc02098a9b2d5033bece068893

File Explorer

2d8f0bfbda3919647d74fe67c6ffd6c25e3203fc02098a9b2d5033bece068893.zip

.zip 113KB
2d8f0bfbda3919647d74fe67c6ffd6c25e3203fc02098a9b2d5033bece068893

.dll 206KB

2d8f0bfbda3919647d74fe67c6ffd6c25e3203fc02098a9b2d5033bece068893.zip

SHA256 ae85ddfa2a5d7b55d5842ceb64d04a108ece01ef8b8c2186a270cd9de5c85284
MD5 62089d4ab5d47a19ff72f0f6842d2040
SHA1 c012cd5b658b76afb144c476c38977738ee61b43
SHA512 671208a9dae98e7f8c8c9ee1f0cae253ec9e2bea45bc2f6e2b55d5d67b73431bb34a891cddea882e313e49682144d8fae1b0a7d45eea94e492d66c2cd1e565d2
SSDEEP 3072:ZkHcjUOCiKp0vvZHPNyCrFaPn0OP1gbFi6GAv2JE:ZLWpqhBac01gbY61QE
TLSH
T183B312860B39622E1BCC16BBF9FB5144770E1E2677428B37DA4E39498D7BC84CD72A11
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

2d8f0bfbda3919647d74fe67c6ffd6c25e3203fc02098a9b2d5033bece068893

IMPHASH 0bc418575efc832b308d227b31192688
SHA256 2d8f0bfbda3919647d74fe67c6ffd6c25e3203fc02098a9b2d5033bece068893
MD5 27134f6b64c199093f2128e1243769c5
SHA1 8a10512ea54c82b3318acd38b7a3b9c8e72d9d42
SHA512 404433c756bae7bdf0971827b7fa4019b6aaef8ad68ffdebc5297c54246e384030d557b3e156bc8d7d6d82c095e3ae2708e2b580693783919305a17dd37e9591
SSDEEP 3072:cxYXMJJciFoSYMoXYQlwfv/gF8jua3PX4Ns5drwolUtaF0XL5DuN:cuXkiq4wfv4Kjnv+srwoRaK
TLSH
T170248CA07091E036D05B0438620BCB7E5BFDF9F41271A487BBD85A5AAE71393EB19347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

650688

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_SYSTEM IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

UpdateProcThreadAttribute HeapFree GetProcessHeap CreateRemoteThread VirtualAlloc VirtualProtectEx VirtualAllocEx LoadLibraryA ProcessIdToSessionId DuplicateHandle InitializeProcThreadAttributeList WriteProcessMemory CreateThread GetThreadContext SetThreadContext FreeLibrary VirtualFree Thread32First Thread32Next SetLastError OpenThread CreateToolhelp32Snapshot GetVersionExA SuspendThread ResumeThread PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState LocalAlloc LocalFree GetComputerNameA Process32First TerminateProcess HeapAlloc ExitProcess DeleteProcThreadAttributeList VirtualProtect FindNextFileA MoveFileA FindClose CopyFileA FindFirstFileA FileTimeToSystemTime GetFileAttributesA ExpandEnvironmentStringsA GetLogicalDrives SystemTimeToTzSpecificLocalTime GetFullPathNameA GetModuleHandleA CreateNamedPipeA GetProcAddress ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetFileTime GetCurrentDirectoryA CreatePipe GetCurrentDirectoryW GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe MultiByteToWideChar CreateProcessA OpenProcess WriteFile SetFileTime WaitForSingleObject SetEnvironmentVariableW CreateFileA Sleep SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA VirtualQuery GetModuleFileNameW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoA HeapSize IsValidCodePage GetCPInfo DebugBreak RaiseException QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetCurrentProcessId GetOEMCP GetLocalTime GetACP Process32Next GetTickCount GetEnvironmentStrings FreeEnvironmentStringsA SetFilePointer GetFileType GetModuleHandleW DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount RtlUnwind WideCharToMultiByte GetConsoleCP GetConsoleMode SetHandleCount

advapi32

RegEnumValueA CloseServiceHandle OpenProcessToken CreateProcessWithLogonW DeleteService CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx LookupAccountSidA GetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCloseKey RegEnumKeyA CreateProcessAsUserA RegOpenCurrentUser RegOpenKeyExA GetUserNameA AdjustTokenPrivileges ControlService QueryServiceStatusEx ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA OpenThreadToken OpenServiceA OpenSCManagerA QueryServiceStatus CreateProcessWithTokenW StartServiceA CreateServiceA

wininet

HttpQueryInfoA InternetQueryDataAvailable InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetOpenA InternetCloseHandle InternetQueryOptionA InternetConnectA

ws2_32

ntohs connect htons socket accept send gethostname inet_ntoa WSAStartup WSACleanup gethostbyname htonl ntohl listen __WSAFDIsSet bind recv shutdown WSAGetLastError select ioctlsocket inet_addr closesocket

dnsapi

DnsFree DnsQuery_A

iphlpapi

GetIfEntry GetIpAddrTable

secur32

LsaCallAuthenticationPackage LsaConnectUntrusted LsaLookupAuthenticationPackage