goopdate.dll
- SHA256 c3dfcd55ea3b621537c1d7170212249d3d12f96a08d0e5c2ed1d4f0cf6036eb6
General
- Target goopdate.dll
- Size 285KB
- Sample200717-5wptmayme6
- SHA256 c3dfcd55ea3b621537c1d7170212249d3d12f96a08d0e5c2ed1d4f0cf6036eb6
Score
10/10
Malware Config
Extracted
Family
-
cobaltstrike
C2
-
http://104.31.76.215:80/jquery-3.3.2.min.js
-
http://172.67.168.227:80/jquery-3.3.2.min.js
-
http://104.31.77.215:80/jquery-3.3.2.min.js
Attributes
-
access_type
512
-
beacon_type
0
-
create_remote_thread
0
-
day
0
-
dns_idle
1.34744072e+08
-
dns_sleep
0
-
host
104.31.76.215,/jquery-3.3.2.min.js,172.67.168.227,/jquery-3.3.2.min.js,104.31.77.215,/jquery-3.3.2.min.js
-
http_header1
AAAAEAAAABhIb3N0OiBzdGF0aWMubWluaXdpc2UubWUAAAAKAAAAC0FjY2VwdDogKi8qAAAACgAAABZBY2NlcHQtTGFuZ3VhZ2U6IGVuLVVTAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAAAAAAADQAAAAIAAAALc2Vzc2lvbl9pZD0AAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAAEAAAABhIb3N0OiBzdGF0aWMubWluaXdpc2UubWUAAAAKAAAAC0FjY2VwdDogKi8qAAAACgAAABNBY2NlcHQtTGFuZ3VhZ2U6IGVuAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAABAAAADQAAAAQAAAAHAAAAAAAAAA0AAAAFAAAAAmlkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
- injection_process
-
jitter
8448
-
maxdns
245
-
month
0
- pipe_name
-
polling_time
37500
-
port_number
80
- proxy_password
- proxy_server
- proxy_username
-
sc_process32
%windir%\syswow64\ktmutil.exe
-
sc_process64
%windir%\sysnative\ktmutil.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCF0Hv1f5APRNApuC/MnRL8V04hCN5gcntJtYm48yXAuZipkyUXHpsUNi1S00duHZ26x62ObQ6fKvEZdG2JopO96tnwbsLSoKAU3ipseIA5tsNrdSWXIl7Gu6arE65eBecdkZ4t3s12EptaiwuoorSSP9rO9yQahF43hN6gsu5ZCQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
9.45165568e+08
-
unknown2
AAAABAAAAAEAAABRAAAAAgAAAFQAAAACAAAAPQAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown3
0
-
unknown4
0
-
unknown5
2.018915346e+09
-
uri
/people/donald-j-trump
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
-
year
0
Signatures
- Cobaltstrike family
File Explorer
-
goopdate.dll