Overview

overview

10

Static

static

3

Public Opi...df.exe

windows7-x64

7

Public Opi...df.exe

windows10-2004-x64

10

Resubmissions

29/06/2023, 17:30

230629-v3m23aed38 10

29/06/2023, 17:22

230629-vxtbwsec98 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Public Opinion Survey.rar

  • Size

    8.2MB

  • Sample

    230629-vxtbwsec98

  • MD5

    ee0577811a3aa38bf544666818164ac5

  • SHA1

    aec098ecaf6a7835a553d44913cc07ccc1d18cf1

  • SHA256

    22db2770a07234e62af0284de292aff33f14473ccccb91f0ac75d1adc89f4261

  • SHA512

    45f9af25cbd28c8baa84a98cf8d6dc1764497347fd1a5ebd0caca574dda325ec800d4beef02b0249d411986c79e9d18cf7e840e6431bcb9ede3f6a793d248776

  • SSDEEP

    196608:4hLBDcRwLZ8N8luJio1bEekt/RKVh3wSk1X/Idni:4j08Mc//RK3ANyi

Score
10/10
cobaltstrike0backdoorpyinstallertrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

0

C2

http://103.147.13.191:39999/push

Attributes
  • access_type

    512

  • host

    103.147.13.191,/push

  • http_header1

    AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • polling_time

    60000

  • port_number

    39999

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCnQDYflk1pwbPeFvpbCJ8VCEXP6Lxa7l1XGNhup5Az0V8ISCRwmSzf8hwM4+RoHYCrwjNbFfcdrxl3qLgP1fExAxTZJBMzoLEzAebSDsBMcz6C/w2WB6yUE/G0jnr1PEPXvvd0/pi2nueWtUY6NLhFdDkCN4ry4frqrlVIi4z2xQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit.php

  • user_agent

    Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; BOIE9;ENUS)

  • watermark

    0

Targets

    • Target

      Public Opinion Survey.pdf .exe

    • Size

      8.6MB

    • MD5

      d65914f8c65c724de65d2f63e97564ea

    • SHA1

      20f224f81a3649a549d4c234d9384fd3357b5127

    • SHA256

      f08acb183d2554fa099f9a7f79fdbf7930a5ec63a39a735b425e0e49049d272f

    • SHA512

      fd29cbd12fbcc7127fdd6f9a1b36842c2faf3870f7219a9229568dbcf4cea914cb1b65fb041f355868e04ebe5036a155e4ae414dfcf4cd9a52d51e10fddae0a9

    • SSDEEP

      196608:nFD95x0MXCpazL2Vmd6+DTJVAzDaku99lEOSEu+07pmP:BZbXCp6L2Vmd6mTJVAzDakAiiulw

    Score
    10/10
    cobaltstrike0backdoortrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks