General
-
Target
4d143f224d4f98442bbc33cc9d713f092840f842015c319e50a24625d5140723
-
Size
1.0MB
-
Sample
230129-t6zdtsea38
-
MD5
e49acdf38fdfd4daed2c22aff37a4bb5
-
SHA1
1b906812158f48dba056c313a87077f41b5b9ada
-
SHA256
4d143f224d4f98442bbc33cc9d713f092840f842015c319e50a24625d5140723
-
SHA512
c01b15473d9a622b296b29ddc6fc0890ade76b56184db84fc1f5810768bc4aff0e5402117faaa1e1ed81a2f8300583689f937947d01b9fa2146745faf77b800d
-
SSDEEP
12288:800QnfcVsbeoAGhxX7/j3YvCHink+6IDOEBjLdi3xTQ0:8ufcVsbefGhxX7/j3IBBjLdi3xT/
Static task
static1
Behavioral task
behavioral1
Sample
4d143f224d4f98442bbc33cc9d713f092840f842015c319e50a24625d5140723.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4d143f224d4f98442bbc33cc9d713f092840f842015c319e50a24625d5140723.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
cobaltstrike
305419896
http://sync.srcb-info.buzz:53/en_US/all.js
-
access_type
512
-
beacon_type
256
-
host
sync.srcb-info.buzz,/en_US/all.js
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
polling_time
60000
-
port_number
53
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5h13I0LHtntwGyfMQ50mwgeQNRoMziUbFacTBFXE6o0aMf2upaKU1zl/ud3VRodQjFZxWn2uqOUp+027mQoZ25IxVFtNU21cf1gMJO4j2vcXVAaTTYPh3NXVJ/LHMyI7f8tgsuXztYUVLsWrLG5VO/UfGom/os0SDAFcwWJzkrwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
-
watermark
305419896
Extracted
cobaltstrike
0
-
watermark
0
Targets
-
-
Target
4d143f224d4f98442bbc33cc9d713f092840f842015c319e50a24625d5140723
-
Size
1.0MB
-
MD5
e49acdf38fdfd4daed2c22aff37a4bb5
-
SHA1
1b906812158f48dba056c313a87077f41b5b9ada
-
SHA256
4d143f224d4f98442bbc33cc9d713f092840f842015c319e50a24625d5140723
-
SHA512
c01b15473d9a622b296b29ddc6fc0890ade76b56184db84fc1f5810768bc4aff0e5402117faaa1e1ed81a2f8300583689f937947d01b9fa2146745faf77b800d
-
SSDEEP
12288:800QnfcVsbeoAGhxX7/j3YvCHink+6IDOEBjLdi3xTQ0:8ufcVsbefGhxX7/j3IBBjLdi3xT/
Score10/10 -