General
-
Target
6471485bd84d8ee6434fdb71e130c4ea660543008d17ebc717a64418744fb45d
-
Size
217KB
-
Sample
201113-bs8gs8dhk2
-
MD5
4c41cf3053b8f9e6eb6a79f45052708d
-
SHA1
783bed1f6de75274330e495de6322e1d1f40f8cd
-
SHA256
6471485bd84d8ee6434fdb71e130c4ea660543008d17ebc717a64418744fb45d
-
SHA512
b2149ba7a274285c8c215bd3f07da4f9e7bd3efc63e9b2c7261e97488fd12721c0de4d231e147a808fcba5bfcf2c36d44c9a09cfa881cca5721ee149b1cdff18
Static task
static1
Behavioral task
behavioral1
Sample
6471485bd84d8ee6434fdb71e130c4ea660543008d17ebc717a64418744fb45d.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
6471485bd84d8ee6434fdb71e130c4ea660543008d17ebc717a64418744fb45d.exe
Resource
win10v20201028
Malware Config
Extracted
cobaltstrike
http://159.246.29.91:443/posting
-
access_type
512
-
beacon_type
2048
-
dns_idle
3.505190168e+09
-
dns_sleep
1.84549376e+09
-
host
159.246.29.91,/posting
-
http_header1
AAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAAAAAAACAAAAAMAAAACAAAAK3dvcmRwcmVzc19kNmMwNDA1ZTBkN2FiMThmZDRlNmEwYjc0ZmNlNDBiMD0AAAAGAAAABkNvb2tpZQAAAAkAAAAQY29udHJvbGxlcj1mYWxzZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAAvQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQAAAAHAAAAAQAAAAgAAAADAAAAAgAAAAh0cmlnZ2VyPQAAAAQAAAAHAAAAAAAAAAMAAAACAAAADl9fc2Vzc2lvbl9faWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
jitter
9472
-
maxdns
253
-
polling_time
8
-
port_number
443
-
sc_process32
%windir%\syswow64\WUAUCLT.exe
-
sc_process64
%windir%\sysnative\WUAUCLT.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCe2Cst86E7+wYlXMCb3gWZ9cwcMpa7ABTmKjQ2X72xWKuCJ6NKaz0Wit1V0MfyhvlyLMxEwbemUxIjcW+mr36nf5LSDNyR2VbEJaDrv4RKVtgBcKc8Q2KDj2Zc1E9RA94tbX/SCdKECej2uqBdhjWDFL21Nu5A7IRgkfZyj5lSPQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4.43751424e+08
-
unknown2
AAAABAAAAAIAAAFSAAAAAwAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/skin
-
user_agent
Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202
Targets
-
-
Target
6471485bd84d8ee6434fdb71e130c4ea660543008d17ebc717a64418744fb45d
-
Size
217KB
-
MD5
4c41cf3053b8f9e6eb6a79f45052708d
-
SHA1
783bed1f6de75274330e495de6322e1d1f40f8cd
-
SHA256
6471485bd84d8ee6434fdb71e130c4ea660543008d17ebc717a64418744fb45d
-
SHA512
b2149ba7a274285c8c215bd3f07da4f9e7bd3efc63e9b2c7261e97488fd12721c0de4d231e147a808fcba5bfcf2c36d44c9a09cfa881cca5721ee149b1cdff18
Score10/10 -