General
-
Target
0212ad8f93405ad10af5abad3b5e8ae5.exe
-
Size
24KB
-
Sample
230319-vs48labd6z
-
MD5
0212ad8f93405ad10af5abad3b5e8ae5
-
SHA1
c9cbaf6b9caff6e02dc43f2ec782d5e24a4852f1
-
SHA256
a58150ce39e22e8e67f9b582c3064cd8701cdabb4f1ac7ae22c8fc6e0bc2e93b
-
SHA512
9af37cc965b2efd0f3dff64ad71b38d832befd30091221a5fa760548857602c9efed8f793992044c6b7733c92526b4a2ef1dbf1a7ee80d792293700e00e6682b
-
SSDEEP
384:qqaCF31cix+Dc4zjuwPLZCFF46gioZUHeMDnG:gMFV+DjrLZ08X
Static task
static1
Behavioral task
behavioral1
Sample
0212ad8f93405ad10af5abad3b5e8ae5.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
0212ad8f93405ad10af5abad3b5e8ae5.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
cobaltstrike
http://117.50.163.24:8443/wEp1
-
user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; MAARJS)
Extracted
cobaltstrike
391144938
http://117.50.163.24:8443/updates.rss
-
access_type
512
-
beacon_type
2048
-
host
117.50.163.24,/updates.rss
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
8443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC+YpGtwdKPfGRXFWZBPsP7Av36wlJiXABRQvtPAs4R3IGcoukN/JOs6InN5+igBf9heKZTWcxWXexG1Rvtysi27gCO2TLltvkMznh49QN1A1U6rinS8CwpHsImjXiqe08RjC7qrOtiHt7di6taz6BruoGnIV5fNrhlQLl9gEihwwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; Touch; ASU2JS)
-
watermark
391144938
Targets
-
-
Target
0212ad8f93405ad10af5abad3b5e8ae5.exe
-
Size
24KB
-
MD5
0212ad8f93405ad10af5abad3b5e8ae5
-
SHA1
c9cbaf6b9caff6e02dc43f2ec782d5e24a4852f1
-
SHA256
a58150ce39e22e8e67f9b582c3064cd8701cdabb4f1ac7ae22c8fc6e0bc2e93b
-
SHA512
9af37cc965b2efd0f3dff64ad71b38d832befd30091221a5fa760548857602c9efed8f793992044c6b7733c92526b4a2ef1dbf1a7ee80d792293700e00e6682b
-
SSDEEP
384:qqaCF31cix+Dc4zjuwPLZCFF46gioZUHeMDnG:gMFV+DjrLZ08X
Score10/10 -