Configuration

101.126.11.79 — x86 — port 80
hash 66d31c30fc945e48dd93c8f80261a9cbb7f1553603cd4b6bc4209fdfb08d2ca0
first 2025-12-19 00:09:15 CET / last 2025-12-19 00:09:15 CET

Attributs

Full JSON (entry)

{
  "protocol": "http",
  "settings": {
    "SETTING_C2_CHUNK_POST": 0,
    "SETTING_C2_RECOVER": [
      [
        "print",
        true
      ],
      [
        "append",
        5
      ],
      [
        "append",
        6
      ],
      [
        "append",
        58
      ],
      [
        "append",
        70
      ],
      [
        "append",
        4
      ],
      [
        "prepend",
        62
      ],
      [
        "prepend",
        80
      ],
      [
        "prepend",
        26
      ],
      [
        "prepend",
        51
      ],
      [
        "prepend",
        57
      ],
      [
        "base64url",
        true
      ]
    ],
    "SETTING_C2_REQUEST": [
      [
        "_HEADER",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
      ],
      [
        "_HEADER",
        "Accept: */*"
      ],
      [
        "_HEADER",
        "Accept-Language: en-US,en;q=0.9"
      ],
      [
        "_HEADER",
        "Accept-Encoding: gzip, deflate, br"
      ],
      [
        "_HEADER",
        "Connection: keep-alive"
      ],
      [
        "_HEADER",
        "Origin: https://www.google.com"
      ],
      [
        "_HEADER",
        "Referer: https://www.google.com/"
      ],
      [
        "_HEADER",
        "Sec-Fetch-Dest: script"
      ],
      [
        "_HEADER",
        "Sec-Fetch-Mode: no-cors"
      ],
      [
        "_HEADER",
        "Sec-Fetch-Site: cross-site"
      ],
      [
        "BUILD",
        "metadata"
      ],
      [
        "BASE64URL",
        true
      ],
      [
        "APPEND",
        "&_ga=GA1.1.1234567890.1234567890"
      ],
      [
        "APPEND",
        "&_gid=GA1.1.987654"
      ]
    ],
    "SETTING_C2_VERB_GET": "GET",
    "SETTING_C2_VERB_POST": "POST",
    "SETTING_CFG_CAUTION": 0,
    "SETTING_CLEANUP": 1,
    "SETTING_CRYPTO_SCHEME": 0,
    "SETTING_DOMAINS": "101.126.11.79,/gtag/js",
    "SETTING_DOMAIN_STRATEGY": 0,
    "SETTING_DOMAIN_STRATEGY_FAIL_SECONDS": 4294967295,
    "SETTING_DOMAIN_STRATEGY_FAIL_X": 4294967295,
    "SETTING_DOMAIN_STRATEGY_SECONDS": 4294967295,
    "SETTING_JITTER": 30,
    "SETTING_MAXGET": 1398521,
    "SETTING_MAX_RETRY_STRATEGY_ATTEMPTS": 0,
    "SETTING_MAX_RETRY_STRATEGY_DURATION": 0,
    "SETTING_MAX_RETRY_STRATEGY_INCREASE": 0,
    "SETTING_PORT": 80,
    "SETTING_PROTOCOL": 0,
    "SETTING_PUBKEY": "d38ae367efa30b262bfbff96e52f677ed9e625f09ea3fc77c5dffd5aa8085663",
    "SETTING_SLEEPTIME": 50000,
    "SETTING_SPAWNTO": "00000000000000000000000000000000",
    "SETTING_SPAWNTO_X64": "%windir%\\sysnative\\svchost.exe",
    "SETTING_SPAWNTO_X86": "%windir%\\syswow64\\svchost.exe",
    "SETTING_SUBMITURI": "/measurement/collect",
    "SETTING_USERAGENT": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
    "SETTING_WATERMARK": 987654321,
    "SETTING_WATERMARKHASH": "NtZOV6JzDr9QkEnX6bobPg=="
  },
  "trial": false,
  "version": "Cobalt Strike 4.8 (Feb 28, 2023)",
  "watermark": 987654321
}