General
-
Target
1e7951add6778a427bd7345202a82dc80f2921a220b45754493710bd0111891a
-
Size
267KB
-
Sample
220612-zt1c9afeal
-
MD5
bc9de322ea25adee65f175b55c704f71
-
SHA1
496a496f182fcf95ed7cd81917663695689dbb44
-
SHA256
1e7951add6778a427bd7345202a82dc80f2921a220b45754493710bd0111891a
-
SHA512
8374dd7382169f660fb38bcf02d528d10a328210b799040faddc0a81de1e782a478d6f4f1f48bae3166810bccc65eee438a9dd7bcdfb3e41392d0f6760546fac
Static task
static1
Behavioral task
behavioral1
Sample
1e7951add6778a427bd7345202a82dc80f2921a220b45754493710bd0111891a.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
1e7951add6778a427bd7345202a82dc80f2921a220b45754493710bd0111891a.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
cobaltstrike
1873433027
http://transguardgroups.net:80/jquery
-
access_type
512
-
beacon_type
256
-
dns_idle
1.34744072e+08
-
host
transguardgroups.net,/jquery
-
http_header1
AAAABwAAAAAAAAANAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAADQAAAAUAAAACaWQAAAAHAAAAAQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
245
-
polling_time
10000
-
port_number
80
-
sc_process32
%windir%\syswow64\gpupdate.exe
-
sc_process64
%windir%\sysnative\gpupdate.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCNTf5SUJjmSmORHM96Ul2RABQAbes2Sl7DJzdYRw4rKmZxXDcPATJdk2T4wlNqFcqKol4FhZsFBMSlxycN5LRF7bZv67tdsMOYtXhVXKhZo/rJwyUe5S3RBPy7quzw6FyDfesLM6PfVX2Ga70UETuzYpxzU4vhmYUxZXWes8KkowIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
1.40929024e+09
-
unknown2
AAAABAAAAAEAAABIAAAAAgAAAAgAAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/Login
-
user_agent
Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.0; .NET CLR 1.0.2914)
-
watermark
1873433027
Extracted
cobaltstrike
0
-
watermark
0
Targets
-
-
Target
1e7951add6778a427bd7345202a82dc80f2921a220b45754493710bd0111891a
-
Size
267KB
-
MD5
bc9de322ea25adee65f175b55c704f71
-
SHA1
496a496f182fcf95ed7cd81917663695689dbb44
-
SHA256
1e7951add6778a427bd7345202a82dc80f2921a220b45754493710bd0111891a
-
SHA512
8374dd7382169f660fb38bcf02d528d10a328210b799040faddc0a81de1e782a478d6f4f1f48bae3166810bccc65eee438a9dd7bcdfb3e41392d0f6760546fac
Score10/10 -