General
-
Target
afaf53de1fceca316ed34804ec5f8264.exe
-
Size
1.5MB
-
Sample
220525-m7y15aaad7
-
MD5
afaf53de1fceca316ed34804ec5f8264
-
SHA1
a8c349fd92f6eb316bb1e3fa8bc9ce60c025da13
-
SHA256
3da3b7a6ce9f51f3298afc7aa931d3178f57b2d1ce857dbd88675c7386866b7e
-
SHA512
56615fc02c80af4661b4efcf43f52c8ccb018943bc348990b4fc09800b5fb4c1e98e2cbcd02d6f5616de89fcc50c71675dfc2ec3ca46ac73b08e6dd638e98c5f
Static task
static1
Behavioral task
behavioral1
Sample
afaf53de1fceca316ed34804ec5f8264.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
afaf53de1fceca316ed34804ec5f8264.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
cobaltstrike
123456789
http://service-bv4lng5j-1307188804.sh.apigw.tencentcs.com:443/search
-
access_type
512
-
beacon_type
2048
-
host
service-bv4lng5j-1307188804.sh.apigw.tencentcs.com,/search
-
http_header1
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAA4Q29va2llOiBEVVA9UT1HcE8xbkpwTW5hbTRVbGxFZm1lTWRnMiZUPTI4Mzc2NzA4OCZBPTEmSUcAAAAKAAAAJlJlZmVyZXI6IGh0dHBzOi8vd3d3LmNsb3VkLnRlbmNlbnQuY29tAAAABwAAAAAAAAADAAAAAgAAAApTRVNTSU9OSUQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAA4Q29va2llOiBEVVA9UT1HcE8xbkpwTW5hbTRVbGxFZm1lTWRnMiZUPTI4Mzc2NzA4OCZBPTEmSUcAAAAHAAAAAAAAAAMAAAACAAAACUpTRVNTSU9OPQAAAAYAAAAGQ29va2llAAAABwAAAAEAAAADAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
2560
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\dllhost.exe
-
sc_process64
%windir%\sysnative\dllhost.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCL5paOYS4Ch1fPxUdk++MXZjFcM7wZwYlNISngRRx0nzl6odYr1pwKR6WAmtf/nWNps+lMhviFYU76dlCjUSHGk6vwoR6YuaS9D93tuFZyzco4ZX6jzlWrKLN9Gl/uC0/9tu6h1DtZ8xBeH0UBeP8+KgzTvXRgdYQq0l0/UaWD1QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
3.82554112e+09
-
unknown2
AAAABAAAAAEAAANBAAAAAgAAAqMAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/switch
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
-
watermark
123456789
Targets
-
-
Target
afaf53de1fceca316ed34804ec5f8264.exe
-
Size
1.5MB
-
MD5
afaf53de1fceca316ed34804ec5f8264
-
SHA1
a8c349fd92f6eb316bb1e3fa8bc9ce60c025da13
-
SHA256
3da3b7a6ce9f51f3298afc7aa931d3178f57b2d1ce857dbd88675c7386866b7e
-
SHA512
56615fc02c80af4661b4efcf43f52c8ccb018943bc348990b4fc09800b5fb4c1e98e2cbcd02d6f5616de89fcc50c71675dfc2ec3ca46ac73b08e6dd638e98c5f
Score10/10 -