cobaltstrike | iZHQ

Sharing

Copy URL Twitter E-mail

General

Target
iZHQ
Size 242KB
Sample261108-w6arksag57
SHA256 508048a022fe22181338bfb68018d86d7acb8ce3bc25aa162bf6d0de9d2e6d7f
MD5 3b20c79c637dfc0b3f3f73782fa15fee
SHA1 6021ac11c829feb3b73c9e44d60bba62cad1f06a
SHA512 ddb36b59e3e26b0a23542d30c609bf53ba9d054216eabe3caf98481eb04da019b9b4eeac96252e696269b176d20e87522c8a0d5634227ad17cafccdabc28a9a5
SSDEEP 6144:+KE2G96U2pNcVh+Si6bsAxWwuj7klr/rIt/6zG6EkGJ:5fhZNc33Uwfe/lqW
TLSH
T18734F10CFF4BD3E159CA0157A26CA62670507B007CE1A7EF84F97B244FE3498685B766
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

987654321 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

987654321

http://complianceportals.com:443/IE9CompatViewList.xml

Attributes

access_type
512
beacon_type
2048
host
complianceportals.com
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDKsUlueYsB7Jh4oANknnD2xzBFMFpixcBuEwYXykd5mKNyPbk33D609HPsjcF0WFPAoS8turmsa1bfzpV6j7nDbVe36w4KvpVwPVdLNKA7kyWOFCFShGWqfUc9NOASbhsxkOc+tHPFYgkAmd0n0Z96D798/BJOJtyuhPJGYHYnAQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; ASU2JS)
watermark
987654321

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

File Explorer

iZHQ

242KB

iZHQ

SHA256 508048a022fe22181338bfb68018d86d7acb8ce3bc25aa162bf6d0de9d2e6d7f
MD5 3b20c79c637dfc0b3f3f73782fa15fee
SHA1 6021ac11c829feb3b73c9e44d60bba62cad1f06a
SHA512 ddb36b59e3e26b0a23542d30c609bf53ba9d054216eabe3caf98481eb04da019b9b4eeac96252e696269b176d20e87522c8a0d5634227ad17cafccdabc28a9a5
SSDEEP 6144:+KE2G96U2pNcVh+Si6bsAxWwuj7klr/rIt/6zG6EkGJ:5fhZNc33Uwfe/lqW
TLSH
T18734F10CFF4BD3E159CA0157A26CA62670507B007CE1A7EF84F97B244FE3498685B766
MD5 SHA1 SHA512 SSDEEP TLSH