General
-
Target
32367083e0b69625ff0271589a90040a46da10e5679e8cdbf4d02c7297efaf8f
-
Size
278KB
-
Sample
211004-1fy4pshccl
-
MD5
f2e30b2ccc8faa80e2539f3ef1862bf9
-
SHA1
182e169aa494427b0d696f5a340e7c34f9c1048d
-
SHA256
32367083e0b69625ff0271589a90040a46da10e5679e8cdbf4d02c7297efaf8f
-
SHA512
9407d20d289fc35cdff45c7e7182f33cae5011c8715c8da684a2126870ab379985d6ab26ca81c7d488e47ec6a59d9c50db5e0309e432753f33b70077db9aa282
Static task
static1
Behavioral task
behavioral1
Sample
32367083e0b69625ff0271589a90040a46da10e5679e8cdbf4d02c7297efaf8f.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
32367083e0b69625ff0271589a90040a46da10e5679e8cdbf4d02c7297efaf8f.exe
Resource
win10v20210408
Malware Config
Extracted
cobaltstrike
1359593325
http://185.82.219.249:80/dot.gif
-
access_type
512
-
host
185.82.219.249,/dot.gif
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
80
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCjC2SAfgijf1DZytSYI6EYyiWG7nfEU59+nL8joKtqwTQFiIx4qzxkEiIsGUnRyjDPt0a9DKEg2/fjjNkLZaCrtG9Hj/L25Gmx5ZFxxT7itBUh9Jozb+vcod/W8PTkf12REl4ZEvndwUNnnHzR9Qb6sLb1BrEOoDE4Ip4UdbQR0QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; NP06)
-
watermark
1359593325
Targets
-
-
Target
32367083e0b69625ff0271589a90040a46da10e5679e8cdbf4d02c7297efaf8f
-
Size
278KB
-
MD5
f2e30b2ccc8faa80e2539f3ef1862bf9
-
SHA1
182e169aa494427b0d696f5a340e7c34f9c1048d
-
SHA256
32367083e0b69625ff0271589a90040a46da10e5679e8cdbf4d02c7297efaf8f
-
SHA512
9407d20d289fc35cdff45c7e7182f33cae5011c8715c8da684a2126870ab379985d6ab26ca81c7d488e47ec6a59d9c50db5e0309e432753f33b70077db9aa282
Score10/10 -