General
-
Target
2b92d90bc6ea883f5744837eed693114c9b6c0b9c11252cec166ddd507bfc676
-
Size
260KB
-
Sample
220320-dv1vhsgaen
-
MD5
c16077b86248bc770d0a8c85d8d76c44
-
SHA1
ec503b958f285e0d31d5e1e25d3c3792fe49c071
-
SHA256
2b92d90bc6ea883f5744837eed693114c9b6c0b9c11252cec166ddd507bfc676
-
SHA512
ef864e8b86efd921a71ecf14444085855bf557f929ceb1b15351133d32909d0358e83d8bc1dea650123ac1a42bd3ba136315fa10a4ab15fed2dd9003423d008b
Static task
static1
Behavioral task
behavioral1
Sample
2b92d90bc6ea883f5744837eed693114c9b6c0b9c11252cec166ddd507bfc676.dll
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
2b92d90bc6ea883f5744837eed693114c9b6c0b9c11252cec166ddd507bfc676.dll
Resource
win10v2004-20220310-en
Malware Config
Extracted
cobaltstrike
1873433027
http://www.qfaet.com:443/en-US/CMSImages/1920/Apps/get
-
access_type
512
-
beacon_type
2048
-
host
www.qfaet.com,/en-US/CMSImages/1920/Apps/get
-
http_header1
AAAACgAAACFSZWZlcmVyOiBodHRwOi8vd3d3LjEyNy4wLjAuMS5jb20AAAAKAAAAWEFjY2VwdDogYXBwbGljYXRpb24veG1sLGFwcGxpY2F0aW9uL3hodG1sK3htbDtxPTAuMix0ZXh0L3BsYWluO3E9MC4zLGltYWdlL2dpZiwqLyo7cT0xLjUAAAAKAAAAH0FjY2VwdC1MYW5ndWFnZTogZW4tdXMsZW47cT0xLjUAAAAHAAAAAAAAAAMAAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAANwaWQAAAAHAAAAAQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
polling_time
10000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCGHDB8HtdqoqtqDfIi75cdCcaxCjEaCzQY4sSX8d5T+FjHOrohXJxENvFuYmAzuBFKulxDfkBg10QbXVA9/WEXMclrUTjnPmE5IxTqqn3yjIxqFR/XW2hLLZhBMZf6jMli0mIHggdd3c3Io/AaSsT1MXmSKWXCCSpH5HE8V69crwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
3.998553344e+09
-
unknown2
AAAABAAAAAEAAAAWAAAAAgAAAIAAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/cdnfiles/external/scripts/post
-
user_agent
IE/11 (Windows; U; MSIE 7.0; Windows NT 10.1) Java/3.2.1_11
-
watermark
1873433027
Targets
-
-
Target
2b92d90bc6ea883f5744837eed693114c9b6c0b9c11252cec166ddd507bfc676
-
Size
260KB
-
MD5
c16077b86248bc770d0a8c85d8d76c44
-
SHA1
ec503b958f285e0d31d5e1e25d3c3792fe49c071
-
SHA256
2b92d90bc6ea883f5744837eed693114c9b6c0b9c11252cec166ddd507bfc676
-
SHA512
ef864e8b86efd921a71ecf14444085855bf557f929ceb1b15351133d32909d0358e83d8bc1dea650123ac1a42bd3ba136315fa10a4ab15fed2dd9003423d008b
Score1/10 -