Overview

overview

10

Static

static

10

495a5948a8...c6.dll

windows7_x64

3

495a5948a8...c6.dll

windows10-2004_x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    495a5948a841e4536db1c295bede5965dc7d2ec4864a3fc6e929eff121b107c6

  • Size

    203KB

  • Sample

    220325-xk3qxagcbn

  • MD5

    ac171c70090b735632f76f7349987081

  • SHA1

    bf26ca1f9d30c1fd082b004c2fe0d02edb5e5dbf

  • SHA256

    495a5948a841e4536db1c295bede5965dc7d2ec4864a3fc6e929eff121b107c6

  • SHA512

    9dca255d579da48b00e7b1716f22d7b5d3cfc7237c2c2365bc94c160e95175d364b49978ae3259ae10106321829a8fae2469d5bc91fcd702b79f96060c126548

Score
10/10
cobaltstrike1359593325

Malware Config

Extracted

Family

cobaltstrike

Botnet

1359593325

C2

http://a0.awsstatic.com:80/

Attributes
  • access_type

    512

  • host

    a0.awsstatic.com,/

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAeR2V0Q29udGVudEZlYXR1cmVzLkRMTkEuT1JHOiAxAAAAEAAAACNIb3N0OiBkMWVoNmZrZXdsYXhzNC5jbG91ZGZyb250Lm5ldAAAAAoAAABIQ29va2llOiAgX191dG1hPTUwOTc4ODY2Ny4wNDgyODI4ODA3LjU5NTkzMzc1MDAuNzY3MzgxNjc2NS42NTY2Mjk2NzE2LjU7AAAACQAAAAl2ZXJzaW9uPTQAAAAJAAAADmxpZD05NjIyNDY4NjQ3AAAABwAAAAAAAAAIAAAABQAAAAV0b2tlbgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAQAAAAI0hvc3Q6IGQxZWg2Zmtld2xheHM0LmNsb3VkZnJvbnQubmV0AAAABwAAAAAAAAAFAAAAA3JpZAAAAAkAAAAObGlkPTQ1Nzk0NjMxMDAAAAAJAAAAH21ldGhvZD1nZXRTZWFyY2hSZWNvbW1lbmRhdGlvbnMAAAAHAAAAAQAAAAMAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    2560

  • polling_time

    970

  • port_number

    80

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCU4Ej/+fRXXgiM8iqMXk/7EEinbIwxij/jzyInJQ4haz7k4G41C1+BI2TpaZASSkYRM9iPBzE6Estft99g/Vy/PTlz3hOW1CdtyMWzZB5Jnni46nhc95YDqTzsbnaoNCIjLbl1sQFr7fCmfKZ8deqUpeVhLpK5//ytPWxsGYp6hwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    7.382016e+08

  • unknown2

    AAAABAAAAAIAAAAQAAAAAgAAABAAAAACAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /radio/xmlrpc/v35

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; WOW64)

  • watermark

    1359593325

Targets

    • Target

      495a5948a841e4536db1c295bede5965dc7d2ec4864a3fc6e929eff121b107c6

    • Size

      203KB

    • MD5

      ac171c70090b735632f76f7349987081

    • SHA1

      bf26ca1f9d30c1fd082b004c2fe0d02edb5e5dbf

    • SHA256

      495a5948a841e4536db1c295bede5965dc7d2ec4864a3fc6e929eff121b107c6

    • SHA512

      9dca255d579da48b00e7b1716f22d7b5d3cfc7237c2c2365bc94c160e95175d364b49978ae3259ae10106321829a8fae2469d5bc91fcd702b79f96060c126548

    Score
    3/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks