General

  • Target

    3dd21d830f6e876e030a7bd76c657ee940afac1785690438475cb0a15c3b1805

  • Size

    206KB

  • Sample

    220701-rqqqmsfhhk

  • MD5

    47e80349b40b21f381458fa84c82cb83

  • SHA1

    d401ad0be19247cef815444621c6c5db5ecea216

  • SHA256

    3dd21d830f6e876e030a7bd76c657ee940afac1785690438475cb0a15c3b1805

  • SHA512

    3b01fe5353ef94ff7961589d31de9fe5b38dc38bb289464dc54fbde56966f7b59d26af4340930dea8cdd438f793e4340422f3acfadf9bf586a4d2af60b8715ce

Score
10/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

0

C2

http://169.239.128.37:80/ga.js

Attributes
  • access_type

    512

  • crypto_scheme

    256

  • host

    169.239.128.37,/ga.js

  • http_header1

    AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • maxdns

    255

  • pipe_name

    \\%s\pipe\msagent_%x

  • polling_time

    60000

  • port_number

    80

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/smxWNf2Ex9B6htFoL4dR15ZVIZQD/PmGcJ/fw1IbCb1Wl1gIlRzUqaF2lVSz1HFeRPkWKLeWhJ/hkIWZ2LwVrVn/UepDfZlzu3Ix7Bs+prTh8o/cRpsGRi4et5TJZ5q6N3WYz24SLsX64iOZNGNTLVH7N0STNJFmqprP56o2pQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit.php

  • user_agent

    Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)

  • watermark

    0

Targets

    • Target

      3dd21d830f6e876e030a7bd76c657ee940afac1785690438475cb0a15c3b1805

    • Size

      206KB

    • MD5

      47e80349b40b21f381458fa84c82cb83

    • SHA1

      d401ad0be19247cef815444621c6c5db5ecea216

    • SHA256

      3dd21d830f6e876e030a7bd76c657ee940afac1785690438475cb0a15c3b1805

    • SHA512

      3b01fe5353ef94ff7961589d31de9fe5b38dc38bb289464dc54fbde56966f7b59d26af4340930dea8cdd438f793e4340422f3acfadf9bf586a4d2af60b8715ce

    Score
    3/10

MITRE ATT&CK Matrix

Tasks