Overview

overview

10

Static

static

10

a4713ece3d6cda_JC.dll

windows7-x64

3

a4713ece3d6cda_JC.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    a4713ece3d6cda_JC.exe

  • Size

    205KB

  • MD5

    a4713ece3d6cdac8e48708dc2cfff4f2

  • SHA1

    95856ddf78130d525a58a970539c0d383a64b570

  • SHA256

    bcf94cbc4b24654b658462b2c4d635be49d29e49e980857bc2197da314190cd5

  • SHA512

    d18b4e910b13d0184002f55ebf33d0dff21f14a0fff768a928fa759c8c618b84b2050c7c8d582843e2a99dc4b36157f0c8a8a8b6bc971af13cdf63151227cc66

  • SSDEEP

    3072:IBaK6WeIBEkOM4tDo8C0Y/9fdlq1TQ3VxLylm6jiMvjEUhJ5nkH:IBaGBEzMiDo8CFVHq1TQ3CjiOjJ

Score
10/10
1234567890cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

1234567890

C2

http://bot.qianxinsecurity.com:53/cm

http://abc.qianxinsecurity.com:53/pixel.gif

http://asssaaass.qianxinsecurity.com:53/dpixel
Attributes
  • access_type

    512

  • beacon_type

    256

  • host

    bot.qianxinsecurity.com,/cm,abc.qianxinsecurity.com,/pixel.gif,asssaaass.qianxinsecurity.com,/dpixel

  • http_method1

    GET

  • http_method2

    POST

  • maxdns

    255

  • polling_time

    60000

  • port_number

    53

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCDiVTmpfGJlzr7JAMra9896sB1NXJ1xuNgXhxcTNYcqNdYhmRQLZr3+wgh5m+im0BxhyWhQPZZuA9M8KCrDxhCgBGKn0PPWaOhXbWJNnrumaemclh23DnpbIfaer36LXHGNuKjVv0I4U8oGlTOFDs2E7jX5IQNVnYttVdv0QzN3QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • watermark

    1234567890

Signatures

  • Cobalt Strike reflective loader 1 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike family
    cobaltstrike
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • a4713ece3d6cda_JC.exe
    .dll windows x86

    71bfcb38e91418de15f7acbbb3b9ca8c


    Headers

    Imports

    Exports

    Sections