General
-
Target
cs.exe
-
Size
219KB
-
Sample
210924-qfkwzahba2
-
MD5
d7f978bb5c5b4847702169e86ec6f60f
-
SHA1
64c3f1b633c9e805aabebe64844b3eebb5deb84c
-
SHA256
58c99ad39b408ae80a7b054f6771ef2290375faa8b6fba46a4958237248e10b9
-
SHA512
2bc30b057b3ba1e70a28e7adb844526c90cb5a3badab42f220ab66efa58900082bfa3fbeab4bef92d106df153ea33887c5fb3b083f9f72236d17160c8b17fb38
Static task
static1
Behavioral task
behavioral1
Sample
cs.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
cs.exe
Resource
win10-en-20210920
Malware Config
Extracted
cobaltstrike
1359593325
http://cdn.atlassian.com:80/v1/updateCheck
http://survey.gallup.com:80/v1/updateCheck
-
access_type
512
-
host
cdn.atlassian.com,/v1/updateCheck,survey.gallup.com,/v1/updateCheck
-
http_header1
AAAACgAAACJBY2NlcHQ6IHRleHQvaHRtbCwgdGV4dC9wbGFpbiwgKi8qAAAACgAAAExBY2NlcHQtTGFuZ3VhZ2U6IHpoLUNOLHpoO3E9MC44LHpoLVRXO3E9MC43LHpoLUhLO3E9MC41LGVuLVVTO3E9MC4zLGVuO3E9MC4yAAAACgAAABZDb25uZWN0aW9uOiBLZWVwLUFsaXZlAAAACgAAABdDYWNoZS1Db250cm9sOiBuby1jYWNoZQAAAAcAAAAAAAAADQAAAAgAAAANAAAABgAAABJCSUdJcFNlcnZlclBPT0xfSUQAAAAJAAAACm9zbmFtZT13aW4AAAAJAAAADmNoYW5uZWw9c3RhYmxlAAAACQAAAAxtaWxlc3RvbmU9ODAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACJBY2NlcHQ6IHRleHQvaHRtbCwgdGV4dC9wbGFpbiwgKi8qAAAACgAAAExBY2NlcHQtTGFuZ3VhZ2U6IHpoLUNOLHpoO3E9MC44LHpoLVRXO3E9MC43LHpoLUhLO3E9MC41LGVuLVVTO3E9MC4zLGVuO3E9MC4yAAAACgAAABZDb25uZWN0aW9uOiBLZWVwLUFsaXZlAAAACgAAABdDYWNoZS1Db250cm9sOiBuby1jYWNoZQAAAAcAAAAAAAAADQAAAAYAAAALeC1jbGllbnQtaWQAAAAHAAAAAQAAAAMAAAAGAAAADngtZW5jcnlwdC1kYXRhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
5120
-
polling_time
10000
-
port_number
80
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCqVFrNofnr4vbdEXJaTCshcOIBqT62V48O48acveHm4RK3C9jVByRMc3bGp5zdHPVCsiPZ56T+dAje8SBq25M8oEisBJBlAYLlSRKREEhW8pYee7QAcaOrIUmAZ642scb+Dpro5DO+JW7i/PPk3rU/R9j5+NVY0vjbiVUG2FSvZwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
1.448416512e+09
-
unknown2
AAAABAAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown3
1.610612736e+09
-
uri
/v1/releaseMgr
-
user_agent
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebkit/537.36 Chrome/71.0.3578.98
-
watermark
1359593325
Targets
-
-
Target
cs.exe
-
Size
219KB
-
MD5
d7f978bb5c5b4847702169e86ec6f60f
-
SHA1
64c3f1b633c9e805aabebe64844b3eebb5deb84c
-
SHA256
58c99ad39b408ae80a7b054f6771ef2290375faa8b6fba46a4958237248e10b9
-
SHA512
2bc30b057b3ba1e70a28e7adb844526c90cb5a3badab42f220ab66efa58900082bfa3fbeab4bef92d106df153ea33887c5fb3b083f9f72236d17160c8b17fb38
Score10/10 -