1735cc49a937d131a2fb9633d0e9da3632ae7a8b5313133240ae3e3338b298bf

General
Target

1735cc49a937d131a2fb9633d0e9da3632ae7a8b5313133240ae3e3338b298bf

Size

255KB

Sample

220315-xwmh3aehf2

Score
10 /10
MD5

3127f330de72d081c7f5b36d86c8868b

SHA1

892b9f732a10c3f4808c986230626d251ed9b9ed

SHA256

1735cc49a937d131a2fb9633d0e9da3632ae7a8b5313133240ae3e3338b298bf

SHA512

cb60a15dd83ece0c68161e1699221104d41eddb32bafb44a3cd736cbb78e2a47e0585cd151ca1eecb3eeedea7260a46fd4411f9884588345dee459c961ec66ab

Malware Config

Extracted

Family cobaltstrike
Botnet 1
C2

http://47.105.115.125:443/waf/

Attributes
access_type
512
beacon_type
2048
host
47.105.115.125,/waf/
http_header1
AAAAEAAAABRIb3N0OiBjZG4uZWNic2NuLmNvbQAAAAoAAABIQWNjZXB0OiB0ZXh0L2h0bWwsYXBwbGljYXRpb24veGh0bWwreG1sLGFwcGxpY2F0aW9uL3htbDtxPTAuOSwqLypsO3E9MC44AAAACgAAAB1SZWZlcmVyOiBodHRwOi8vd3d3LmVic2NuLmNvbQAAAAoAAAAQUHJhZ21hOiBuby1jYWNoZQAAAAoAAAAXQ2FjaGUtQ29udHJvbDogbm8tY2FjaGUAAAAHAAAAAAAAAAgAAAABAAAABC0uanMAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAAEAAAABRIb3N0OiBjZG4uZWNic2NuLmNvbQAAAAoAAAAmQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi9vY3RldC1zdHJlYW0AAAAKAAAAHVJlZmVyZXI6IGh0dHA6Ly93d3cuZWJzY24uY29tAAAACgAAABBQcmFnbWE6IG5vLWNhY2hlAAAACgAAABdDYWNoZS1Db250cm9sOiBuby1jYWNoZQAAAAcAAAAAAAAACwAAAAEAAAAELmFzcAAAAAwAAAAHAAAAAQAAAAMAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
2560
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCAi0D+bLB3YEsvngzOUSkbHih+GnA7yFkgpRMNgXLC0y1s90mqDp3/vn8cJoWlZ5sB3l9P+o0YztyYg/jY1cB2EDHqTUh3BLEwLXrrb+Qc++uSUKlMf8GVXgzeGhvw0dtGjXM327jTGuAJ3PEG+g5XCunHfe0Qtu1jtBQg6MYh9QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
1.481970944e+09
unknown2
AAAABAAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/history/
user_agent
Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0
watermark
1
Targets
Target

1735cc49a937d131a2fb9633d0e9da3632ae7a8b5313133240ae3e3338b298bf

MD5

3127f330de72d081c7f5b36d86c8868b

Filesize

255KB

Score
3/10
SHA1

892b9f732a10c3f4808c986230626d251ed9b9ed

SHA256

1735cc49a937d131a2fb9633d0e9da3632ae7a8b5313133240ae3e3338b298bf

SHA512

cb60a15dd83ece0c68161e1699221104d41eddb32bafb44a3cd736cbb78e2a47e0585cd151ca1eecb3eeedea7260a46fd4411f9884588345dee459c961ec66ab

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Tasks

                          static1

                          10/10

                          behavioral1

                          1/10

                          behavioral2

                          3/10