-
Notifications
You must be signed in to change notification settings - Fork 24
/
2022-01-25_CobaltStrikeConfigs
122 lines (110 loc) · 3.68 KB
/
2022-01-25_CobaltStrikeConfigs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
Cobalt Strike beacons on the same range.
Reference: https://twitter.com/Max_Mal_/status/1485984545623134213 (#Emotet infection leads to #CobaltStrike)
####################################################
https://172.241.27.107/
C2 Server: repigeleli.com (/ro.html)
Watermark: 1580103814
BeaconType: HTTPS
Port: 443
UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246
HttpPostUri: /fam_newspaper
SleepTime: 5000
MaxGetSize: 2796804
Jitter: 15
MaxDNS: Not Found
PublicKey MD5: db61a374b7fb8a975193dd10a016565c
Malleable C2 Instructions: Remove 600 bytes from the beginning
Base64 decode
NetBIOS decode 'a'
Spawnto_x86: %windir%\syswow64\rundll32.exe
Spawnto_x64: %windir%\sysnative\rundll32.exe
####################################################
https://172.241.27.123/
C2 Server: vafici.com (/ba.js)
Watermark: 1580103814
BeaconType: HTTPS
Port: 443
UserAgent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0
HttpPostUri: /FAQ
SleepTime: 5000
MaxGetSize: 2797078
Jitter: 8
MaxDNS: Not Found
PublicKey MD5: a8bff98c789f609084be10dcc6e564c9
Malleable C2 Instructions: Remove 874 bytes from the beginning
Base64 decode
NetBIOS decode 'a'
Spawnto_x86: %windir%\syswow64\mstsc.exe
Spawnto_x64: %windir%\sysnative\mstsc.exe
####################################################
https://172.241.27.128/
C2 Server: ragojel.com (/RELEASE)
Watermark: 1580103814
BeaconType: HTTPS
Port: 443
UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_2) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/601.3.9
HttpPostUri: /sitemap
SleepTime: 5000
MaxGetSize: 1864740
Jitter: 23
MaxDNS: Not Found
PublicKey MD5: 7863048c80cb32b195977ec72bcf7b51
Malleable C2 Instructions: Remove 600 bytes from the beginning
Base64 decode
Base64 decode
Spawnto_x86: %windir%\syswow64\rundll32.exe
Spawnto_x64: %windir%\sysnative\rundll32.exe
####################################################
https://172.241.27.198/
C2 Server: sufebul.com (/en.js)
Watermark: 1580103814
BeaconType: HTTPS
Port: 443
UserAgent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0
HttpPostUri: /FAQ
SleepTime: 5000
MaxGetSize: 2797085
Jitter: 7
MaxDNS: Not Found
PublicKey MD5: f3b81a729b58e699e306e87bd53e13f1
Malleable C2 Instructions: Remove 881 bytes from the beginning
Base64 decode
NetBIOS decode 'A'
Spawnto_x86: %windir%\syswow64\mstsc.exe
Spawnto_x64: %windir%\sysnative\mstsc.exe
####################################################
https://172.241.27.230/
C2 Server: lawapuyal.com (/posting)
Watermark: 0
BeaconType: HTTPS
Port: 443
UserAgent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202
HttpPostUri: /eo
SleepTime: 5000
MaxGetSize: 1864474
Jitter: 27
MaxDNS: Not Found
PublicKey MD5: d6014c2eb47d9335aed2ecbd039d8e53
Malleable C2 Instructions: Remove 338 bytes from the beginning
Base64 decode
Base64 URL-safe decode
Spawnto_x86: %windir%\syswow64\rundll32.exe
Spawnto_x64: %windir%\sysnative\rundll32.exe
####################################################
https://172.241.27.248/
C2 Server: zolewiso.com (/panel)
Watermark: 0
BeaconType: HTTPS
Port: 443
UserAgent: Mozilla/5.0 (Windows Phone 10.0; Android 6.0.1; Microsoft; RM-1152) AppleWebKit/537.36 (KHTML, like Gecko)
HttpPostUri: /tab_home_active
SleepTime: 5000
MaxGetSize: 1398446
Jitter: 28
MaxDNS: Not Found
PublicKey MD5: af242ec456596684cd6984f5d480bceb
Malleable C2 Instructions: Remove 338 bytes from the beginning
Base64 decode
XOR mask w/ random key
Spawnto_x86: %windir%\syswow64\rundll32.exe
Spawnto_x64: %windir%\sysnative\rundll32.exe