General
-
Target
2a1a3f6f1f138cf46a4aca66b22a2d4298a12e2115511127919a63b9150f4aa3
-
Size
277KB
-
Sample
210111-yfzxslysln
-
MD5
9b8892d3af5dcca1022eaeabc2948074
-
SHA1
207e448a72aadde3c1c13bb1be3c2ddb3fcc89d8
-
SHA256
2a1a3f6f1f138cf46a4aca66b22a2d4298a12e2115511127919a63b9150f4aa3
-
SHA512
f3053f3cffba152098cdaee1513522fe0ab3edc053b5c372d5ac3e65391f51c4054e595db2dfa155b9d6475e63eba3e8e18d86cc82d1935f94d74116b0e36f95
Static task
static1
Behavioral task
behavioral1
Sample
2a1a3f6f1f138cf46a4aca66b22a2d4298a12e2115511127919a63b9150f4aa3.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
2a1a3f6f1f138cf46a4aca66b22a2d4298a12e2115511127919a63b9150f4aa3.exe
Resource
win10v20201028
Malware Config
Extracted
cobaltstrike
http://213.135.78.244:443/hr.css
-
access_type
512
-
beacon_type
2048
-
dns_sleep
1.6777216e+08
-
host
213.135.78.244,/hr.css
-
http_header1
AAAAEAAAABRIb3N0OiBuczEucmVkdGVhbS5ydQAAAAoAAAARQ29ubmVjdGlvbjogY2xvc2UAAAAKAAAAPUFjY2VwdC1MYW5ndWFnZTogZnItQ0gsIGZyO3E9MC45LCBlbjtxPTAuOCwgZGU7cT0wLjcsICo7cT0wLjUAAAAHAAAAAAAAAAMAAAADAAAAAgAAACt3b3JkcHJlc3NfZWQxZjYxN2JiZDZjMDA0Y2MwOWUwNDZmM2MxYjcxNDg9AAAABgAAAAZDb29raWUAAAAJAAAADGNvbXBhbnk9dHJ1ZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAAEAAAABRIb3N0OiBuczEucmVkdGVhbS5ydQAAAAoAAAARQ29ubmVjdGlvbjogY2xvc2UAAAAKAAAAGENvbnRlbnQtVHlwZTogdGV4dC9wbGFpbgAAAAcAAAABAAAACwAAAAMAAAAEAAAABwAAAAAAAAADAAAAAgAAAA5fX3Nlc3Npb25fX2lkPQAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
jitter
10496
-
maxdns
250
-
polling_time
3000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPZKC+d3OyhV69kk6cGbPoYKTNrNH2sYMeWXGPxQBx5lnHleIFkX3RTzNGyie4YHpwQvslXPmPxbPywD3W9lLsU6hrvNs1mHxIXqe8d6fe2KLThQIzh29Z2KWyIuTSoOiJos0doSdrrs0g8eUNEZUGwnqJY/Lq2wAmlXNcyYBFAQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
2.641697792e+09
-
unknown2
AAAABAAAAAIAAAPVAAAAAwAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/tab_shop_active
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.111 Safari/537.36
Targets
-
-
Target
2a1a3f6f1f138cf46a4aca66b22a2d4298a12e2115511127919a63b9150f4aa3
-
Size
277KB
-
MD5
9b8892d3af5dcca1022eaeabc2948074
-
SHA1
207e448a72aadde3c1c13bb1be3c2ddb3fcc89d8
-
SHA256
2a1a3f6f1f138cf46a4aca66b22a2d4298a12e2115511127919a63b9150f4aa3
-
SHA512
f3053f3cffba152098cdaee1513522fe0ab3edc053b5c372d5ac3e65391f51c4054e595db2dfa155b9d6475e63eba3e8e18d86cc82d1935f94d74116b0e36f95
Score10/10 -