Overview

overview

10

Static

static

10

2b7476087a...b8.dll

windows7_x64

3

2b7476087a...b8.dll

windows10-2004_x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2b7476087a78f3e830eeb49fe74017268bdcd36d62f793cd109cddff5907a9b8

  • Size

    205KB

  • Sample

    220320-d347xagba8

  • MD5

    ac0880577037eafe5a430604164c3637

  • SHA1

    0cdd851a0547d269b79d97b135d236e445d1207e

  • SHA256

    2b7476087a78f3e830eeb49fe74017268bdcd36d62f793cd109cddff5907a9b8

  • SHA512

    b59575f00f3c648721440d8a7915b797c8e313c1dd45feb5db558a462273ae22b97110fe2565e9920509d546b6bdbcbf5b2e277c6283e3932f492169fb9d265a

Score
10/10
cobaltstrike1

Malware Config

Extracted

Family

cobaltstrike

Botnet

1

C2

http://36.103.247.11:80/visit.js

http://61.156.152.51:80/fwlink

http://122.228.0.143:80/pixel.gif

http://122.228.0.169:80/updates.rss

http://113.59.43.25:80/__utm.gif

http://124.152.41.39:80/push
Attributes
  • access_type

    512

  • host

    36.103.247.11,/visit.js,61.156.152.51,/fwlink,122.228.0.143,/pixel.gif,122.228.0.169,/updates.rss,113.59.43.25,/__utm.gif,124.152.41.39,/push

  • http_header1

    AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • polling_time

    60000

  • port_number

    80

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCazWg8exxAVQjvR/5w327Y78gwyuDH0YMzNHmHxTH5u5ZJfzyYvM+WxUYB3Zb4WRoQbnSTq9haPn6k8OKo4ZZjvgbTj3eWbc5emAS9eanVAd36xLhbGSP0cthHu5mscOLLunrJEWPyi/alG9rkdiud4mPCpv1M/Dq+nqxDEkwGowIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit.php

  • user_agent

    Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENIN)

  • watermark

    1

Targets

    • Target

      2b7476087a78f3e830eeb49fe74017268bdcd36d62f793cd109cddff5907a9b8

    • Size

      205KB

    • MD5

      ac0880577037eafe5a430604164c3637

    • SHA1

      0cdd851a0547d269b79d97b135d236e445d1207e

    • SHA256

      2b7476087a78f3e830eeb49fe74017268bdcd36d62f793cd109cddff5907a9b8

    • SHA512

      b59575f00f3c648721440d8a7915b797c8e313c1dd45feb5db558a462273ae22b97110fe2565e9920509d546b6bdbcbf5b2e277c6283e3932f492169fb9d265a

    Score
    3/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks