Overview

overview

10

Static

static

10

b1a280c8b7...ed.dll

windows10-2004-x64

3

b1a280c8b7...ed.dll

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    b1a280c8b7eeb9edcdee0e550a90e6fa1c7495716a9d8dddc7c2418d91066aed.zip
  • Size 114KB
  • Sample261024-mfv56ahs8z
  • SHA256 07282352525aa34c43a5c9cd30171e500db76edecc670a7b7995b49695c4665e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
305419896trojanbackdoorcobaltstrike

Malware Config

Extracted

Family

  • cobaltstrike

Botnet

  • 305419896

C2

  • http://ns1.twescoapp.com:53/msdownload/update/2011/04/windows6.1-kb98218-v3-x86_0c754.psf

  • http://ns2.twescoapp.com:53/msdownload/update/2011/04/windows6.1-kb98218-v3-x86_0c754.psf

Attributes
  • access_type

    512

  • beacon_type

    256

  • dns_idle

    2.01638247e+08

  • host

    ns1.twescoapp.com,ns2.twescoapp.com

  • http_header1

    AAAACgAAABhDb25uZWN0aW9uOiA6IEtlZXAtQWxpdmUAAAAKAAAADUFjY2VwdDogOiAqLyoAAAAKAAAAG0FjY2VwdC1FbmNvZGluZzogOiBpZGVudGl0eQAAAAoAAAAgVXNlci1BZ2VudDogOiBNaWNyb3NvZnQgQklUUy83LjUAAAAQAAAAI0hvc3Q6IGF1LmRvd25sb2FkLndpbmRvd3N1cGRhdGUuY29tAAAABwAAAAAAAAANAAAAAgAAAAZSYW5nZT0AAAAGAAAABVJhbmdlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAABhDb25uZWN0aW9uOiA6IEtlZXAtQWxpdmUAAAAKAAAADUFjY2VwdDogOiAqLyoAAAAKAAAAG0FjY2VwdC1FbmNvZGluZzogOiBpZGVudGl0eQAAAAoAAAAgVXNlci1BZ2VudDogOiBNaWNyb3NvZnQgQklUUy83LjUAAAAQAAAAI0hvc3Q6IGF1LmRvd25sb2FkLndpbmRvd3N1cGRhdGUuY29tAAAABwAAAAAAAAAPAAAADQAAAAIAAAAGYnl0ZXM9AAAABgAAAAVSYW5nZQAAAAcAAAABAAAADwAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    5120

  • maxdns

    235

  • polling_time

    60000

  • port_number

    53

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCfXp2xBZGRE6pUzeRMXVtYjZ7k2V0ZMLpWihn1BOUojrUEb/2XMKxbHGyuK/y9ndfo3ZOo5zqcCmDsIU5NGUMfLcb5dcQfxwFAAa6lShoVrE2P/XuUr9/WekoVf2FfQIr14Soe1mUe6tJsCgukpYuLQOcJdFUVQMjMswDBwpS5YQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    9.73344768e+08

  • unknown2

    AAAABAAAAAEAAAA1AAAAAgAABAEAAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /msdownload/update/2011/04/windows6.1-kb98218-v3-x64_0c754.psf

  • user_agent

    User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0

  • watermark

    305419896

Signatures

  • Family: Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • b1a280c8b7eeb9edcdee0e550a90e6fa1c7495716a9d8dddc7c2418d91066aed.zip
    .zip 114KB
  • b1a280c8b7eeb9edcdee0e550a90e6fa1c7495716a9d8dddc7c2418d91066aed
    .dll 202KB

b1a280c8b7eeb9edcdee0e550a90e6fa1c7495716a9d8dddc7c2418d91066aed.zip

  • SHA256 07282352525aa34c43a5c9cd30171e500db76edecc670a7b7995b49695c4665e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected