-
Notifications
You must be signed in to change notification settings - Fork 24
/
2022-03-22_CobaltStrike_IcedID
86 lines (79 loc) · 2.66 KB
/
2022-03-22_CobaltStrike_IcedID
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
C2 de Cobalt Strike muy posiblemente relacionados a IcedID.
Basic configs:
23.227.198.203 | C2 bupdater.com | Watermark 1580103824
23.227.198.210 | C2 accessdbpro.com | Watermark 0
23.227.198.211 | C2 wirelesswebaccess.com | Watermark 0
149.255.35.83 | C2 datasafenetworks.com | Watermark 305419776
Full configs:
####################################################
https://23.227.198.203:757/
C2 Server: bupdater.com (/link.css)
Watermark: 1580103824
BeaconType: HTTP
Port: 80
UserAgent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0
HttpPostUri: /sm
SleepTime: 55479
MaxGetSize: 2797971
Jitter: 41
MaxDNS: Not Found
PublicKey MD5: defb5d95ce99e1ebbf421a1a38d9cb64
Malleable C2 Instructions: Remove 1767 bytes from the beginning
Base64 decode
NetBIOS decode 'a'
Spawnto_x86: %windir%\syswow64\runonce.exe
Spawnto_x64: %windir%\sysnative\runonce.exe
####################################################
https://23.227.198.210:757/
C2 Server: accessdbpro.com (/case)
Watermark: 0
BeaconType: HTTP
Port: 80
UserAgent: Mozilla/5.0 (Linux; Android 6.0; HTC One X10 Build/MRA58K; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0
HttpPostUri: /aa
SleepTime: 59130
MaxGetSize: 2796542
Jitter: 39
MaxDNS: Not Found
PublicKey MD5: cd9393fbaa16026406bfa8b815b7fe7b
Malleable C2 Instructions: Remove 338 bytes from the beginning
Base64 decode
NetBIOS decode 'a'
Spawnto_x86: %windir%\syswow64\WUAUCLT.exe
Spawnto_x64: %windir%\sysnative\WUAUCLT.exe
####################################################
https://23.227.198.211:757/
C2 Server: wirelesswebaccess.com (/ky.js)
Watermark: 0
BeaconType: HTTPS
Port: 757
UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_2) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/601.3.9
HttpPostUri: /aa
SleepTime: 63615
MaxGetSize: 2797346
Jitter: 41
MaxDNS: Not Found
PublicKey MD5: bf6c1276396833997ac56d66fe66ee87
Malleable C2 Instructions: Remove 1142 bytes from the beginning
Base64 decode
NetBIOS decode 'A'
Spawnto_x86: %windir%\syswow64\WUAUCLT.exe
Spawnto_x64: %windir%\sysnative\WUAUCLT.exe
####################################################
https://149.255.35.83:787/
C2 Server: datasafenetworks.com (/ak)
Watermark: 305419776
BeaconType: HTTPS
Port: 787
UserAgent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.111 Safari/537.36
HttpPostUri: /av
SleepTime: 58397
MaxGetSize: 1864740
Jitter: 37
MaxDNS: Not Found
PublicKey MD5: 398711e98db85e6512d4c2dcb600cc78
Malleable C2 Instructions: Remove 600 bytes from the beginning
Base64 decode
Base64 decode
Spawnto_x86: %windir%\syswow64\regsvr32.exe
Spawnto_x64: %windir%\sysnative\regsvr32.exe