General
-
Target
8f96176279d6d78c3e40044939e028e6.bin
-
Size
145KB
-
Sample
230322-b2vwqseb83
-
MD5
e8788a519d922976954e322e95695c60
-
SHA1
67a864c1627adfb3d53e72341a29f9427ba28e14
-
SHA256
37988c39e788ca66369a5bbadc79a317ff4df94eef891c249c72c18cd82420ec
-
SHA512
f2f75c6c21eafef72e4c0ed088686061ef82d2c3f2e125c8a7efa250ce3e1e13407315065aef88ca9fb482105458aacc7ec96be9648eb6afbfe8a624cc5d9c42
-
SSDEEP
3072:+dmbRq/JTusQqtmkU2Gstbzfh8i9GvgqUSF8K4JZtIi02uziIzkcBDBEw:+dmbRqVusQqtmkU21tbzJ8i9mUS6lTIp
Behavioral task
behavioral1
Sample
f404d26706ef08f01e7d08bd24e572c523085f2c07601390c42e64261bc6df98.ps1
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
f404d26706ef08f01e7d08bd24e572c523085f2c07601390c42e64261bc6df98.ps1
Resource
win10v2004-20230220-en
Malware Config
Extracted
cobaltstrike
100000
http://152.89.196.245:6789/match
-
access_type
512
-
host
152.89.196.245,/match
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
6789
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCGFu6deNj54GwQLP/gvk2IXPhruZshiQwL+BaZCmm7xzfvvedCsNPTMAP+e3/zIeWtvCIby0zsYFDuKnF38h/iLsx3/vugYI9OQgXer0XD6u2mw0uO2bTdGz17fVzT4rJwxJo5PcF3qf/SXprY5GtDWKYffr6NCSrsLFDS2oLpbwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUSMSCOM)
-
watermark
100000
Targets
-
-
Target
f404d26706ef08f01e7d08bd24e572c523085f2c07601390c42e64261bc6df98.ps1
-
Size
279KB
-
MD5
8f96176279d6d78c3e40044939e028e6
-
SHA1
92b67e98138f65bbb6469afafb71cd49cde7a321
-
SHA256
f404d26706ef08f01e7d08bd24e572c523085f2c07601390c42e64261bc6df98
-
SHA512
252bbfa9101662d59101d0599665cb3d41b7138742987b4ed3d1ee7a611e91b172a45c0a41ad0ee7d3514be08b0a83e827717e300df71a9e35535cb9219418e4
-
SSDEEP
6144:oxzX5tk9wGd8b6JDuwgCNx88x/4eVU68RgRXswQqn:+/kp8b6JDzxoqg8xRXQu
Score10/10-
Blocklisted process makes network request
-