General
-
Target
1735cc49a937d131a2fb9633d0e9da3632ae7a8b5313133240ae3e3338b298bf
-
Size
255KB
-
Sample
220315-xwmh3aehf2
-
MD5
3127f330de72d081c7f5b36d86c8868b
-
SHA1
892b9f732a10c3f4808c986230626d251ed9b9ed
-
SHA256
1735cc49a937d131a2fb9633d0e9da3632ae7a8b5313133240ae3e3338b298bf
-
SHA512
cb60a15dd83ece0c68161e1699221104d41eddb32bafb44a3cd736cbb78e2a47e0585cd151ca1eecb3eeedea7260a46fd4411f9884588345dee459c961ec66ab
Static task
static1
Behavioral task
behavioral1
Sample
1735cc49a937d131a2fb9633d0e9da3632ae7a8b5313133240ae3e3338b298bf.dll
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
1735cc49a937d131a2fb9633d0e9da3632ae7a8b5313133240ae3e3338b298bf.dll
Resource
win10v2004-20220310-en
Malware Config
Extracted
cobaltstrike
1
http://47.105.115.125:443/waf/
-
access_type
512
-
beacon_type
2048
-
host
47.105.115.125,/waf/
-
http_header1
AAAAEAAAABRIb3N0OiBjZG4uZWNic2NuLmNvbQAAAAoAAABIQWNjZXB0OiB0ZXh0L2h0bWwsYXBwbGljYXRpb24veGh0bWwreG1sLGFwcGxpY2F0aW9uL3htbDtxPTAuOSwqLypsO3E9MC44AAAACgAAAB1SZWZlcmVyOiBodHRwOi8vd3d3LmVic2NuLmNvbQAAAAoAAAAQUHJhZ21hOiBuby1jYWNoZQAAAAoAAAAXQ2FjaGUtQ29udHJvbDogbm8tY2FjaGUAAAAHAAAAAAAAAAgAAAABAAAABC0uanMAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAAEAAAABRIb3N0OiBjZG4uZWNic2NuLmNvbQAAAAoAAAAmQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi9vY3RldC1zdHJlYW0AAAAKAAAAHVJlZmVyZXI6IGh0dHA6Ly93d3cuZWJzY24uY29tAAAACgAAABBQcmFnbWE6IG5vLWNhY2hlAAAACgAAABdDYWNoZS1Db250cm9sOiBuby1jYWNoZQAAAAcAAAAAAAAACwAAAAEAAAAELmFzcAAAAAwAAAAHAAAAAQAAAAMAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
2560
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCAi0D+bLB3YEsvngzOUSkbHih+GnA7yFkgpRMNgXLC0y1s90mqDp3/vn8cJoWlZ5sB3l9P+o0YztyYg/jY1cB2EDHqTUh3BLEwLXrrb+Qc++uSUKlMf8GVXgzeGhvw0dtGjXM327jTGuAJ3PEG+g5XCunHfe0Qtu1jtBQg6MYh9QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
1.481970944e+09
-
unknown2
AAAABAAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/history/
-
user_agent
Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0
-
watermark
1
Targets
-
-
Target
1735cc49a937d131a2fb9633d0e9da3632ae7a8b5313133240ae3e3338b298bf
-
Size
255KB
-
MD5
3127f330de72d081c7f5b36d86c8868b
-
SHA1
892b9f732a10c3f4808c986230626d251ed9b9ed
-
SHA256
1735cc49a937d131a2fb9633d0e9da3632ae7a8b5313133240ae3e3338b298bf
-
SHA512
cb60a15dd83ece0c68161e1699221104d41eddb32bafb44a3cd736cbb78e2a47e0585cd151ca1eecb3eeedea7260a46fd4411f9884588345dee459c961ec66ab
Score3/10 -