General
-
Target
a6113e8a0387832bd3b05a6f3e70c2cc.exe
-
Size
207KB
-
MD5
87a41e0d6e797735e64d97d212822385
-
SHA1
7c1730296e69ead34e5642f284b86eebc87632a5
-
SHA256
9b233994400898091ccf11650beeab0d234ca3c9c5472dcbaa95360eb14d5516
-
SHA512
f1df064842a028af7b3325026638a6b2faf720de0d9330debe6045484af5595a4b9476a57ef20d3e817c457f2f4e7be0b5c9cea5873470d5d1d7d7feb0098208
Malware Config
Extracted
cobaltstrike
http://www.battllestategames.com:8443/jquery-3.3.1.min.js
-
access_type
512
-
beacon_type
2048
-
create_remote_thread
0
-
day
0
-
dns_idle
1.34744072e+08
-
dns_sleep
0
-
host
www.battllestategames.com,/jquery-3.3.1.min.js
-
http_header1
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAVSG9zdDogY29kZS5qcXVlcnkuY29tAAAACgAAACBSZWZlcmVyOiBodHRwOi8vY29kZS5qcXVlcnkuY29tLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAANAAAAAgAAAAlfX2NmZHVpZD0AAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAVSG9zdDogY29kZS5qcXVlcnkuY29tAAAACgAAACBSZWZlcmVyOiBodHRwOi8vY29kZS5qcXVlcnkuY29tLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAAPAAAADQAAAAUAAAAIX19jZmR1aWQAAAAHAAAAAQAAAA8AAAANAAAABAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
- injection_process
-
jitter
9472
-
maxdns
255
-
month
0
- pipe_name
-
polling_time
1000
-
port_number
8443
- proxy_password
- proxy_server
- proxy_username
-
sc_process32
%windir%\syswow64\svchost.exe -k netsvcs
-
sc_process64
%windir%\sysnative\svchost.exe -k netsvcs
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCifBWIfY18+40oMmyLWIWMmsoqmq76d3bnM3/uQ6IDtV6Si8iXHZcGSujzu5OPmEprHaPai2yImreYPjBAxJ3M2jDVOOOeI5/q2Ymcd3ywzV5zPjSDZBT71cmuIMQdYviP70nmq0J6JcFJIFiSX0IpPpHZNsgRw0aQSpO9wwM9EwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4.234810624e+09
-
unknown2
AAAABAAAAAEAAAXyAAAAAgAAAFQAAAACAAAPWwAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown3
0
-
unknown4
0
-
unknown5
0
-
uri
/jquery-3.3.2.min.js
-
user_agent
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 7.0; InfoPath.3; .NET CLR 3.1.40767; Trident/6.0; en-IN)
-
year
0
Signatures
-
Cobaltstrike family
Files
-
a6113e8a0387832bd3b05a6f3e70c2cc.exe