Overview

overview

10

Static

static

10

015023eca9...3b.dll

windows7_x64

1

015023eca9...3b.dll

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    015023eca9b453647fb666de2d78ffa308cf284717f134e54dd0528229cef53b

  • Size

    208KB

  • Sample

    220315-mgkqtacabj

  • MD5

    b9633de88b7e0f25893cb43a878aa2b6

  • SHA1

    9de65ed6b6de7c28077189b1fb8c2cab06f83808

  • SHA256

    015023eca9b453647fb666de2d78ffa308cf284717f134e54dd0528229cef53b

  • SHA512

    96df62fe3fc4db59cc1de67c36567de39bb5f5c55318bd32b35b49b9042eac37aebd03d1889ae40021b9fa673a6ddf4e59b4387202ce213c6880df41c3d4d498

Score
10/10
cobaltstrike1873433027

Malware Config

Extracted

Family

cobaltstrike

Botnet

1873433027

C2

http://108.61.160.9:443/fwlink

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    108.61.160.9,/fwlink

  • http_header1

    AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • maxdns

    255

  • polling_time

    60000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCq3Z45eGoXqw1qI2HXzUJDk2UvoR7SNe0ds00fVF7bTw6r8TQH20ZMF0eW3ONdzKMHBJVbBSpSys67mKUdsRd07K/JgQed9N7FcA2rW6hEnExh4BFLG/cMBPgLFh6ImG5kdEBZIrSp0CLJAlPQOw/QBZq44ZPM8pyPHv/ANp8IZwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit.php

  • user_agent

    Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)

  • watermark

    1873433027

Targets

    • Target

      015023eca9b453647fb666de2d78ffa308cf284717f134e54dd0528229cef53b

    • Size

      208KB

    • MD5

      b9633de88b7e0f25893cb43a878aa2b6

    • SHA1

      9de65ed6b6de7c28077189b1fb8c2cab06f83808

    • SHA256

      015023eca9b453647fb666de2d78ffa308cf284717f134e54dd0528229cef53b

    • SHA512

      96df62fe3fc4db59cc1de67c36567de39bb5f5c55318bd32b35b49b9042eac37aebd03d1889ae40021b9fa673a6ddf4e59b4387202ce213c6880df41c3d4d498

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks