General
-
Target
cs.exe
-
Size
219KB
-
Sample
210924-qjzjjahahm
-
MD5
2ecd65950269336d24e8de0413fce158
-
SHA1
c521bbf4d212df861bececc86ab8a58d0dffc43c
-
SHA256
15f61307b521c6c1bf445d1065ed94ded22fef1350bc931ac7b169a52bd39d22
-
SHA512
67b88bd1bdad40b6eb3a6cd4eefc90a1d84741acc571d5982dc81cb3a51849a81b83dc16d30d24ab9ef5b92982eb35dfe022cff30c9252793f84ec7f03d2550f
Static task
static1
Behavioral task
behavioral1
Sample
cs.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
cs.exe
Resource
win10-en-20210920
Malware Config
Extracted
cobaltstrike
1359593325
http://ec2-54-183-123-73.us-west-1.compute.amazonaws.com:8743/v1/updateCheck
-
access_type
512
-
beacon_type
2048
-
host
ec2-54-183-123-73.us-west-1.compute.amazonaws.com,/v1/updateCheck
-
http_header1
AAAACgAAACJBY2NlcHQ6IHRleHQvaHRtbCwgdGV4dC9wbGFpbiwgKi8qAAAACgAAAExBY2NlcHQtTGFuZ3VhZ2U6IHpoLUNOLHpoO3E9MC44LHpoLVRXO3E9MC43LHpoLUhLO3E9MC41LGVuLVVTO3E9MC4zLGVuO3E9MC4yAAAACgAAABZDb25uZWN0aW9uOiBLZWVwLUFsaXZlAAAACgAAABdDYWNoZS1Db250cm9sOiBuby1jYWNoZQAAAAcAAAAAAAAADQAAAAgAAAANAAAABgAAABJCSUdJcFNlcnZlclBPT0xfSUQAAAAJAAAACm9zbmFtZT13aW4AAAAJAAAADmNoYW5uZWw9c3RhYmxlAAAACQAAAAxtaWxlc3RvbmU9ODAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACJBY2NlcHQ6IHRleHQvaHRtbCwgdGV4dC9wbGFpbiwgKi8qAAAACgAAAExBY2NlcHQtTGFuZ3VhZ2U6IHpoLUNOLHpoO3E9MC44LHpoLVRXO3E9MC43LHpoLUhLO3E9MC41LGVuLVVTO3E9MC4zLGVuO3E9MC4yAAAACgAAABZDb25uZWN0aW9uOiBLZWVwLUFsaXZlAAAACgAAABdDYWNoZS1Db250cm9sOiBuby1jYWNoZQAAAAcAAAAAAAAADQAAAAYAAAALeC1jbGllbnQtaWQAAAAHAAAAAQAAAAMAAAAGAAAADngtZW5jcnlwdC1kYXRhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
5120
-
polling_time
10000
-
port_number
8743
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCqVFrNofnr4vbdEXJaTCshcOIBqT62V48O48acveHm4RK3C9jVByRMc3bGp5zdHPVCsiPZ56T+dAje8SBq25M8oEisBJBlAYLlSRKREEhW8pYee7QAcaOrIUmAZ642scb+Dpro5DO+JW7i/PPk3rU/R9j5+NVY0vjbiVUG2FSvZwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
1.448416512e+09
-
unknown2
AAAABAAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown3
1.610612736e+09
-
uri
/v1/releaseMgr
-
user_agent
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebkit/537.36 Chrome/71.0.3578.98
-
watermark
1359593325
Targets
-
-
Target
cs.exe
-
Size
219KB
-
MD5
2ecd65950269336d24e8de0413fce158
-
SHA1
c521bbf4d212df861bececc86ab8a58d0dffc43c
-
SHA256
15f61307b521c6c1bf445d1065ed94ded22fef1350bc931ac7b169a52bd39d22
-
SHA512
67b88bd1bdad40b6eb3a6cd4eefc90a1d84741acc571d5982dc81cb3a51849a81b83dc16d30d24ab9ef5b92982eb35dfe022cff30c9252793f84ec7f03d2550f
Score10/10 -