Static

static

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    dump.bin

  • Size

    260KB

  • MD5

    aa9b9775160f8198bec7cfbdb39781d3

  • SHA1

    df933630caa036fa1bcc1b68f4f2279d4820c20e

  • SHA256

    2835133dc9982d18dfd35231c7915de643c4ff097d392c4a5fbe850c5b2e5981

  • SHA512

    db054e8cd5ea7997c0d826d1a26c015753140d6438244e05329c20c004afa8663671fd13fc42bc95306314e31259a4b12204ba25cdae34ba4275bd4f14bce3f9

  • SSDEEP

    3072:L+zSu9py9ntNkpl+9/gpHVnCEJE2Kj2lTaIRuiQN3yz94s47YJgv6EAmra5v:L+zdpE9IpHVnCEDTx8l1yz967KEFa5v

Score
10/10
1234567890cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

1234567890

C2

http://ns1.cmbchina.com:53/static/mancard/img/qrcode_download_john.png

http://ns2.starbucksvip.com:53/static/mancard/img/qrcode_download_john.png

http://ns1.starbucksvip.com:53/static/mancard/img/qrcode_download_john.png
Attributes
  • access_type

    512

  • beacon_type

    256

  • host

    ns1.cmbchina.com,/static/mancard/img/qrcode_download_john.png,ns2.starbucksvip.com,/static/mancard/img/qrcode_download_john.png,ns1.starbucksvip.com,/static/mancard/img/qrcode_download_john.png

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    3840

  • maxdns

    255

  • polling_time

    10000

  • port_number

    53

  • sc_process32

    %windir%\syswow64\gpupdate.exe

  • sc_process64

    %windir%\sysnative\gpupdate.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCMWH8bl3svLfma8ViTE43AfGKOYMiD+8mkliIHx6/026JBDTamAQ/5g39ToyuIPtwQD6fDZLLwG3PJcS8a0Rqr7OMhMkYMp0aOR7BL4FalPE5ow0vuzc5lu17AjLh2n1AMna9I3JguEHU5ohxw5nIAuyKBp9V21OD48pgLVBlhvQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • watermark

    1234567890

Signatures

Files

  • dump.bin
    .dll windows x64

    b94d41357331ae8b817fc38e31c96d36


    Headers

    Imports

    Exports

    Sections