Overview

overview

10

Static

static

Scripting_tEst

windows10_x64

10

Resubmissions

28-07-2020 18:55

200728-shcd5fqrvs 10

28-07-2020 18:40

200728-27yx74yche 1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    csload_85981ab0c81cf5a4b8482d.exe

  • Size

    591KB

  • Sample

    200728-shcd5fqrvs

  • MD5

    38f7f5c3cea9ee30ed73baa32e4c9576

  • SHA1

    e7d6c72bb4eacc78915ebb3c4c90dddb9587032d

  • SHA256

    91e18e5e048b39dfc8d250ae54471249d59c637e7a85981ab0c81cf5a4b8482d

  • SHA512

    56d305a6ec3521d8b1c1a8bf694777a0b43a6c10f8efadcfd2f202e138d6dd15842e5d4227cb662497b77d9dadf905dd54f375ba2c28adaa8fdd7edcdbaa3bdf

Score
10/10

Malware Config

Extracted

Family

cobaltstrike

C2

http://cofeedback.com:443/jquery-3.3.1.min.js

Attributes
  • access_type

    512

  • beacon_type

    2048

  • dns_idle

    1.908702538e+09

  • host

    cofeedback.com,/jquery-3.3.1.min.js

  • http_header1

    AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAgUmVmZXJlcjogaHR0cDovL2NvZGUuanF1ZXJ5LmNvbS8AAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADQAAAAIAAAAJX19jZmR1aWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAgUmVmZXJlcjogaHR0cDovL2NvZGUuanF1ZXJ5LmNvbS8AAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADwAAAA0AAAAFAAAACF9fY2ZkdWlkAAAABwAAAAEAAAAPAAAADQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    9472

  • maxdns

    255

  • polling_time

    45000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDVuOdErPprr9fGi2krArCU/lZdMiXdyysa71MRRUPzrQbdvQxKbrgBGY+OJzA/ifB0pa1zQ1KZ14b/GlF4j5yrkCpss9fzIHHWEb26DJeqwR5mfUSOGQU5QP25Zhw2VkP3PcSh3I7U5biQiZuBTGd07IH/0EY/KNu1WvtrmYDzYwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4.234810624e+09

  • unknown2

    AAAABAAAAAEAAAXyAAAAAgAAAFQAAAACAAAPWwAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /jquery-3.3.2.min.js

  • user_agent

    Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

Targets

    • Target

      csload_85981ab0c81cf5a4b8482d.exe

    • Size

      591KB

    • MD5

      38f7f5c3cea9ee30ed73baa32e4c9576

    • SHA1

      e7d6c72bb4eacc78915ebb3c4c90dddb9587032d

    • SHA256

      91e18e5e048b39dfc8d250ae54471249d59c637e7a85981ab0c81cf5a4b8482d

    • SHA512

      56d305a6ec3521d8b1c1a8bf694777a0b43a6c10f8efadcfd2f202e138d6dd15842e5d4227cb662497b77d9dadf905dd54f375ba2c28adaa8fdd7edcdbaa3bdf

    Score
    10/10
    behavioral1

MITRE ATT&CK Matrix

Tasks