General
-
Target
3ce6bb17232c37befcaeadbdc09b8b5eb2ea79cca138aeb20ac1df899e19af6b
-
Size
255KB
-
Sample
220316-pg778abgcn
-
MD5
a359a6304f506dbc73bac7b6fbaa68dc
-
SHA1
b811495c07ce65da8090bd2cecc46a4d2755a37f
-
SHA256
3ce6bb17232c37befcaeadbdc09b8b5eb2ea79cca138aeb20ac1df899e19af6b
-
SHA512
574870767a2741ddcab80d6e543e28ca4e6d3902779144b479a9cc06c62ffc953c9f40b24ee7791009afed008c6791df12d2aa87b88e57d7ea4a0b4f28964103
Static task
static1
Behavioral task
behavioral1
Sample
3ce6bb17232c37befcaeadbdc09b8b5eb2ea79cca138aeb20ac1df899e19af6b.dll
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
3ce6bb17232c37befcaeadbdc09b8b5eb2ea79cca138aeb20ac1df899e19af6b.dll
Resource
win10v2004-20220310-en
Malware Config
Extracted
cobaltstrike
1359593325
http://35.188.165.10:80/ptj
-
access_type
512
-
host
35.188.165.10,/ptj
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
80
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCsW1RQTeAWH9sVCL0hDhLmDMabQMGoUSfvLY/SzrT2QdiFA523rmZSqSp1OLv8HYZbPE3khf+Teq+iYtFV9NLmW3vDLhzVS6f85lFYR3CwaB41C9CCrOzznSsbq9uCgpQ7gcfh+9uqDzKBceXoqCqAP68YA/71fjA8blVcEqdtZwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0)
-
watermark
1359593325
Targets
-
-
Target
3ce6bb17232c37befcaeadbdc09b8b5eb2ea79cca138aeb20ac1df899e19af6b
-
Size
255KB
-
MD5
a359a6304f506dbc73bac7b6fbaa68dc
-
SHA1
b811495c07ce65da8090bd2cecc46a4d2755a37f
-
SHA256
3ce6bb17232c37befcaeadbdc09b8b5eb2ea79cca138aeb20ac1df899e19af6b
-
SHA512
574870767a2741ddcab80d6e543e28ca4e6d3902779144b479a9cc06c62ffc953c9f40b24ee7791009afed008c6791df12d2aa87b88e57d7ea4a0b4f28964103
Score1/10 -