2026-09-30_0966fcfbf30874452b3d0ec70382f573_cobalt-strike_elex_glassworm_gobot_icedid_njrat
Bot C2 commands, persistence, obfuscation
IRC C2 backdoor with remote commandsIRC PRIVMSG binary copies files
SHA-256cece839f46ebad3a1845f8d7b51fe9f071d2311cea49436b11f386884062cb0f
Evidence
⋯7 more rows
0x732c0100000020000000ffffffff12000000.... ...........
0x733c446f776e6c6f61642066696e69736865Download finishe
0x734c64210000ffffffff180000004572726fd!..........Erro
0x735c72207768696c6520646f776e6c6f6164r while download
⋯11 more rows
0x741cf05b8be55dc30000ffffffff12000000.[..]...........
0x742c4578656375746520636f6d706c657465Execute complete
0x743c64210000ffffffff050000004572726fd!..........Erro
0x744c72000000558bec5153568945fc8b45fcr...U..QSV.E..E.
⋯7 more rows
⋯5 more rows
0x7cdcdb8be55dc3000000ffffffff1b000000...]............
0x7cec4e69636b6e616d6520697320616c7265Nickname is alre
0x7cfc61647920696e207573652e00ffffffffady in use......
0x7d0c050000004e49434b20000000ffffffff....NICK .......
0x7d1c010000005b000000ffffffff01000000....[...........
0x7d2c5d000000ffffffff020000000d0a0000]...............
0x7d3cffffffff0600000050494e47203a0000........PING :..
0x7d4cffffffff040000004d4f544400000000........MOTD....
0x7d5cffffffff050000004a4f494e20000000........JOIN ...
0x7d6cffffffff020000000a0d0000ffffffff................
0x7d7c060000006c6f67696e200000ffffffff....login ......
0x7d8c0100000020000000ffffffff07000000.... ...........
0x7d9c505249564d534700ffffffff01000000PRIVMSG.........
0x7dac3a000000ffffffff0400000051554954:...........QUIT
0x7dbc00000000ffffffff0b0000004b494c4c............KILL
0x7dcc50524f4345535300ffffffff0f000000PROCESS.........
0x7ddc50726f63657373206b696c6c65642100Process killed!.
0x7decffffffff1500000050726f6365737320........Process
0x7dfc6e616d65206d697373696e6721000000name missing!...
0x7e0cffffffff070000004558454355544500........EXECUTE.
0x7e1cffffffff1200000046696c65206e616d........File nam
0x7e2c65206d697373696e67210000ffffffffe missing!......
0x7e3c08000000444f574e4c4f414400000000....DOWNLOAD....
0x7e4cffffffff0600000044454c4554450000........DELETE..
⋯7 more rows
0x7ecc656e616d65210000ffffffff0a000000ename!..........
0x7edc444953434f4e4e4543540000ffffffffDISCONNECT......
0x7eec0a000000485454505345525645520000....HTTPSERVER..
0x7efcffffffff07000000687474703a2f2f00........http://.
⋯7 more rows
⋯3 more rows
0xd0dc00000000010000000000000001000000................
0xd0ec00000000010000000000000001000000................
0xd0fc00000000000000000000000000000000................
0xd10c00000000000000000000000000000000................
⋯4 more rows
0xd15c150016001700180019001a001b001c00................
0xd16c1d001e001f0020002100220023002400...... .!.".#.$.
0xd17c250026002700280029002a002b002c00%.&.'.(.).*.+.,.
0xd18c2d002e002f0030003100320033003400-.../.0.1.2.3.4.
0xd19c350036003700380039003a00400040005.6.7.8.9.:.@.@.
0xd1ac40004000400040004000400040004000@.@.@.@.@.@.@.@.
0xd1bc40004000400040004000400040004000@.@.@.@.@.@.@.@.
0xd1cc40004000400040004000400040004000@.@.@.@.@.@.@.@.
0xd1dc40004000400040004000400040004000@.@.@.@.@.@.@.@.
0xd1ec40004000400040004000400040004000@.@.@.@.@.@.@.@.
0xd1fc40004000400040004000400040004000@.@.@.@.@.@.@.@.
0xd20c40004000400040004000400040004000@.@.@.@.@.@.@.@.
0xd21c40004000400040004000400040004000@.@.@.@.@.@.@.@.
0xd22c40004000400040004000400040004000@.@.@.@.@.@.@.@.
⋯12 more rows
⋯5 more rows
0xdeea70726f66696c6572006c6162656c7300profiler.labels.
0xdefa64697361626c65642d62792d64656661disabled-by-defa
0xdf0a756c742d6d656d6f72792d696e667261ult-memory-infra
0xdf1a006e6174697665005c62005c66006770.native.\b.\f.gp
⋯11 more rows
⋯5 more rows
0x1e4d167206164647265737320666f726d2e0ag address form..
0x1e4e1202020203c666f726d20616374696f6e <form action
0x1e4f13d2268747470733a2f2f7777772e6578="https://www.ex
0x1e501616d706c652e636f6d2f22206d657468ample.com/" meth
0x1e5116f643d22504f5354222069643d227368od="POST" id="sh
0x1e521697070696e67223e0a202020203c6c61ipping">. <la
0x1e53162656c20666f723d2266697273746e61bel for="firstna
⋯11 more rows