General
-
Target
4bc53e792de348252f0a8408c20401f49f14c0f5203db3c2da58d0b480bdd588.exe
-
Size
953KB
-
Sample
210215-l9vlvv4vv2
-
MD5
d550d858363f6f0b949947e3dbd65aa9
-
SHA1
7f13b0e4eea98b36bfc6e0dab186314b243de8b6
-
SHA256
4bc53e792de348252f0a8408c20401f49f14c0f5203db3c2da58d0b480bdd588
-
SHA512
8917d413b0be51a89c6779776169823e34a769a32d68e7933fadedd399997c329306711ca118d570aa0a2246be8a234de2ccd780344603297e7d1d89dc78e655
Malware Config
Extracted
cobaltstrike
http://finderout.com:443/mobile-ipad-home.css
-
access_type
512
-
beacon_type
2048
-
host
finderout.com,/mobile-ipad-home.css
-
http_header1
AAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAAAAAAACAAAAAMAAAACAAAABUxTSUQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAAlQWNjZXB0LUxhbmd1YWdlOiBlbi1HQjtxPTAuOSwgKjtxPTAuNwAAAAoAAAAvQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQAAAAHAAAAAQAAAA0AAAADAAAAAgAAAARlcnI9AAAABAAAAAcAAAAAAAAAAwAAAAIAAAAOX19zZXNzaW9uX19pZD0AAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
9984
-
polling_time
62775
-
port_number
443
-
sc_process32
%windir%\syswow64\runonce.exe
-
sc_process64
%windir%\sysnative\runonce.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCqYh8cVES0yDiEPG+l4zcdm5m/8cIb0/LCaGTamJaEdqZLaf0Yoj8NDkxgPVd2HR5ebE6nzeB19zccAcJL6K035zcB1ILdOs3WcSx7w5Ttjj1HUupJ89cGg54VizVFemxiEYCKoa8AoKImQsTruCkrMOH7cM0LGiLDfA7Vknn6MQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
8.27921664e+08
-
unknown2
AAAABAAAAAIAAAPVAAAAAwAAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/massaction
-
user_agent
Mozilla/5.0 (Linux; Android 6.0; HTC One X10 Build/MRA58K; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0
Targets
-
-
Target
4bc53e792de348252f0a8408c20401f49f14c0f5203db3c2da58d0b480bdd588.exe
-
Size
953KB
-
MD5
d550d858363f6f0b949947e3dbd65aa9
-
SHA1
7f13b0e4eea98b36bfc6e0dab186314b243de8b6
-
SHA256
4bc53e792de348252f0a8408c20401f49f14c0f5203db3c2da58d0b480bdd588
-
SHA512
8917d413b0be51a89c6779776169823e34a769a32d68e7933fadedd399997c329306711ca118d570aa0a2246be8a234de2ccd780344603297e7d1d89dc78e655
Score10/10-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Dave packer
Detects executable packed with a packer named 'Dave' from the community, due to a string at the end of it.
-