General
-
Target
f404d26706ef08f01e7d08bd24e572c523085f2c07601390c42e64261bc6df98.zip
-
Size
145KB
-
Sample
230321-rw8teadb5x
-
MD5
f989723447be2e85db72b94f95cdf34c
-
SHA1
c0dd44054108bac46fd5500fa70c31a12d01249d
-
SHA256
51a6cfe2097ea2e03ff885a6fe0083cfcd59e6042dbe8205834f3f9de88a8a9a
-
SHA512
3dbbf8fd32a2561aff791364ec75b6a1853ea33f9a7efa119d316187ede1b6d9453cc8b114ed739fedc4e53c2bfa24ae604a4ce7bc8f509bc766b168a9aba91f
-
SSDEEP
3072:Fd+tiVt8+sMhZ6c5cDCIyus9l30z+j24wVx62ngje9YrCnfX7z:FEt/+sVzWT3qJx5gUYWLz
Behavioral task
behavioral1
Sample
f404d26706ef08f01e7d08bd24e572c523085f2c07601390c42e64261bc6df98.ps1
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
f404d26706ef08f01e7d08bd24e572c523085f2c07601390c42e64261bc6df98.ps1
Resource
win10v2004-20230220-en
Malware Config
Extracted
cobaltstrike
100000
http://152.89.196.245:6789/match
-
access_type
512
-
host
152.89.196.245,/match
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
6789
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCGFu6deNj54GwQLP/gvk2IXPhruZshiQwL+BaZCmm7xzfvvedCsNPTMAP+e3/zIeWtvCIby0zsYFDuKnF38h/iLsx3/vugYI9OQgXer0XD6u2mw0uO2bTdGz17fVzT4rJwxJo5PcF3qf/SXprY5GtDWKYffr6NCSrsLFDS2oLpbwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUSMSCOM)
-
watermark
100000
Targets
-
-
Target
f404d26706ef08f01e7d08bd24e572c523085f2c07601390c42e64261bc6df98.ps1
-
Size
279KB
-
MD5
8f96176279d6d78c3e40044939e028e6
-
SHA1
92b67e98138f65bbb6469afafb71cd49cde7a321
-
SHA256
f404d26706ef08f01e7d08bd24e572c523085f2c07601390c42e64261bc6df98
-
SHA512
252bbfa9101662d59101d0599665cb3d41b7138742987b4ed3d1ee7a611e91b172a45c0a41ad0ee7d3514be08b0a83e827717e300df71a9e35535cb9219418e4
-
SSDEEP
6144:oxzX5tk9wGd8b6JDuwgCNx88x/4eVU68RgRXswQqn:+/kp8b6JDzxoqg8xRXQu
Score10/10-
Blocklisted process makes network request
-