General
-
Target
2310697b68f1dbff6e56acbb1ed8e2a40942c9605cbd33459a3491dc62962da9
-
Size
224KB
-
Sample
230213-wxbmhsed9v
-
MD5
ffd17891937db6bed20fb4cdc505aca3
-
SHA1
33efdbcdb890969aefba5f737fb0154f72dc554e
-
SHA256
2310697b68f1dbff6e56acbb1ed8e2a40942c9605cbd33459a3491dc62962da9
-
SHA512
37e33bf6dde1738422168ec2a97f56c64fd3c803aec01f0c5c17f48220e2b66df006c1ed5187c0b82f2e8485dfcbc6f22332092494d1590489cb9a585c4abcd9
-
SSDEEP
6144:lIbbXQ/EQmM3wurAznrFOrbjqrXaONrUWwvhMASPMV/ko:lEXFQsnrOvqmZh1Rk
Behavioral task
behavioral1
Sample
2310697b68f1dbff6e56acbb1ed8e2a40942c9605cbd33459a3491dc62962da9.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2310697b68f1dbff6e56acbb1ed8e2a40942c9605cbd33459a3491dc62962da9.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
cobaltstrike
1873433027
http://207.246.86.81:8888/ca
-
access_type
512
-
host
207.246.86.81,/ca
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
polling_time
60000
-
port_number
8888
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCu1J0lc0u3IVghMjfJkWfvU7dTF7z0XjJYuW5Vfj0/psuNNob6jSzpqNAYslE7dDDRyMV1jObnI4KtGuPmEKjWlRu/lw3h4ICic267JN0RVWZHUOffI+QU0+3fRU43gnJDfiVasJDgl4UukZOJRH7BV6WEmoK0ZF1cJCMNt8H+NwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; yie9)
-
watermark
1873433027
Targets
-
-
Target
2310697b68f1dbff6e56acbb1ed8e2a40942c9605cbd33459a3491dc62962da9
-
Size
224KB
-
MD5
ffd17891937db6bed20fb4cdc505aca3
-
SHA1
33efdbcdb890969aefba5f737fb0154f72dc554e
-
SHA256
2310697b68f1dbff6e56acbb1ed8e2a40942c9605cbd33459a3491dc62962da9
-
SHA512
37e33bf6dde1738422168ec2a97f56c64fd3c803aec01f0c5c17f48220e2b66df006c1ed5187c0b82f2e8485dfcbc6f22332092494d1590489cb9a585c4abcd9
-
SSDEEP
6144:lIbbXQ/EQmM3wurAznrFOrbjqrXaONrUWwvhMASPMV/ko:lEXFQsnrOvqmZh1Rk
Score10/10 -