General
-
Target
6125217607483392.zip
-
Size
339KB
-
Sample
220208-3fz24sgdf8
-
MD5
06135773334e2223283b3af90484d41a
-
SHA1
f708a2fd434734e80bac1c523ef842eb3be73e66
-
SHA256
f372a06adbd98cf4d91f4b95b6d0aa57fea4116e2580453aa3c56c14fd2cf939
-
SHA512
e5c55abd8e63a8933ea55dc9e9765f38065f6b08a8853a2bb21b0b9273c0675f86a80d9d94135a5cd74ae47ccd714f14746add015615f212df34460b9b646e7e
Static task
static1
Behavioral task
behavioral1
Sample
a9eba0329eea37792ff440b3bcc85f5998caad3f046882a169e0d44c0e9c9369.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
a9eba0329eea37792ff440b3bcc85f5998caad3f046882a169e0d44c0e9c9369.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
metasploit
windows/download_exec
http://185.150.119.157:80/static-directory/kj.png
- headers Host: citrixseruritys.com Connection: close User-Agent: Mozilla/5.0 (Linux; Android 6.0; HTC One X10 Build/MRA58K; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0
Extracted
cobaltstrike
1359593325
http://185.150.119.157:80/ml.css
-
access_type
512
-
host
185.150.119.157,/ml.css
-
http_header1
AAAAEAAAABlIb3N0OiBjaXRyaXhzZXJ1cml0eXMuY29tAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAAlQWNjZXB0LUxhbmd1YWdlOiBlbi1HQjtxPTAuOSwgKjtxPTAuNwAAAAcAAAAAAAAADQAAAAMAAAACAAAAK3dvcmRwcmVzc181MjIzODU1OGU5MzBmMWVjNjk5ZTRmMTJhYjAxNWE0Zj0AAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAAEAAAABlIb3N0OiBjaXRyaXhzZXJ1cml0eXMuY29tAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAAlQWNjZXB0LUxhbmd1YWdlOiBlbi1HQjtxPTAuOSwgKjtxPTAuNwAAAAoAAAAYQ29udGVudC1UeXBlOiB0ZXh0L3BsYWluAAAABwAAAAEAAAADAAAAAwAAAAQAAAAHAAAAAAAAAAMAAAACAAAADl9fc2Vzc2lvbl9faWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
10496
-
polling_time
62412
-
port_number
80
-
sc_process32
%windir%\syswow64\runonce.exe
-
sc_process64
%windir%\sysnative\runonce.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJvC2CQYaIouT41kXKVNrM5lLvclGJRE+i3ves+vC0AADUWTPs64Dn/B4eKlQKPpbC/8IgJjadD/B9pZiY8XUlk4dvaagLdjBCq7uSxS+KhVVsX46LBSBgIxaE4AeoZvwBD2n0wdeeI2sbkMvDhhv5s6Nmz12sAtOVGdr8cX3s5QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
2.17567488e+09
-
unknown2
AAAABAAAAAIAAAPVAAAAAwAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/FAQ
-
user_agent
Mozilla/5.0 (Linux; Android 6.0; HTC One X10 Build/MRA58K; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0
-
watermark
1359593325
Targets
-
-
Target
a9eba0329eea37792ff440b3bcc85f5998caad3f046882a169e0d44c0e9c9369
-
Size
633KB
-
MD5
c23e8aacaeb1d23041a7f1d0b70ac9ee
-
SHA1
b6a46cc2b0523238b120b14b52f5f4902e088667
-
SHA256
a9eba0329eea37792ff440b3bcc85f5998caad3f046882a169e0d44c0e9c9369
-
SHA512
3883e1200e6665442e21fc0159389789677629a304b056226e15e331cc00e386b407b8f904af6ef0b544acf8099fd769ee82da5db7581f51af544dd6f8412061
Score10/10-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-