cobaltstrike | d546c9d600790ab57726d62c6cf1ad48a3c959f5070eb6153adb70ddf4696bea

General

Target
d546c9d600790ab57726d62c6cf1ad48a3c959f5070eb6153adb70ddf4696bea
Size 3.9MB
Sample261107-kqlclaay3v
SHA256 d546c9d600790ab57726d62c6cf1ad48a3c959f5070eb6153adb70ddf4696bea
MD5 73033bd65413de9dda2f83403eebebdd
SHA1 a1eb38eacd08e2a9c8d9970ff56cec16bd0ae1ad
SHA512 e747d50b76473749d9b0f1ea8328217e653ff36dcadacf0db831e7511478fe99ef460ceb847ea4356a67bf002bd8788daec41fbfd03edced45184fd466f93b5f
SSDEEP 49152:m7gqGSFAo6bfwBXvKXX1X6R2PrA3gvdI3UYj1JxKSZE9qZ0SAtermFELK3n7L+u:mMNeCTX16R2PaiYjgSZE9A0S+erpcSu
TLSH
T1EB16D08BBCA448F6D0AA9232497660557B31BC480F3153D72A60B6FD2FB27E49E7C750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

987654321

C2

http://195.86.147.250:6766/__utm.gif

Attributes

access_type
512
host
195.86.147.250
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
month
3.3554432e+07
polling_time
60000
port_number
6766
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCt2wCXlG/qiOBm23k4vhzzgy+/RO+JUF+Sh6Qk8XE9ispm8AvS5LykNsm16RNx+920Gofe2LAMLo0WZcNBVoTNoRh0arBC5xYqeWYASwMGapUeGb4ZElKoFBG2i14cWq/Ape4AiD7yX4AR+dQpUnlUnFjLopTUXg+5Wvyr7XSoQwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)
watermark
987654321

Targets

- Target
  d546c9d600790ab57726d62c6cf1ad48a3c959f5070eb6153adb70ddf4696bea
- Size 3.9MB
- SHA256 d546c9d600790ab57726d62c6cf1ad48a3c959f5070eb6153adb70ddf4696bea
- MD5 73033bd65413de9dda2f83403eebebdd
- SHA1 a1eb38eacd08e2a9c8d9970ff56cec16bd0ae1ad
- SHA512 e747d50b76473749d9b0f1ea8328217e653ff36dcadacf0db831e7511478fe99ef460ceb847ea4356a67bf002bd8788daec41fbfd03edced45184fd466f93b5f
- SSDEEP 49152:m7gqGSFAo6bfwBXvKXX1X6R2PrA3gvdI3UYj1JxKSZE9qZ0SAtermFELK3n7L+u:mMNeCTX16R2PaiYjgSZE9A0S+erpcSu
- TLSH
  T1EB16D08BBCA448F6D0AA9232497660557B31BC480F3153D72A60B6FD2FB27E49E7C750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor 987654321 cobaltstrike trojan
- Family: Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
behavioral1