General
-
Target
a44437840df59ce1bc5e8e62bb30f9e70780cb43e765371c2164a3d7b17c97ba.exe
-
Size
482KB
-
Sample
230720-hjtz2sdc47
-
MD5
bf8bb1c9ecdf500509da77710ce46e37
-
SHA1
611d9fe71b64e28db13f46b8567e489412a1cc11
-
SHA256
a44437840df59ce1bc5e8e62bb30f9e70780cb43e765371c2164a3d7b17c97ba
-
SHA512
0e126e0da0676cfea7a2495df55ef87d604e7022f46c38eae1e14e5704037a2fa5baec9107ceee832a4228cb19cbe8b1a934379bde47562208ce3b8117e83f46
-
SSDEEP
6144:7ui+uaL5WmwBJA+lxJA1jyxPWIgtij3Hfx4JFHpFO8rgrFREj5nrfO1o3jcaXVr8:qiX7j/A+qjytWL07fCTOlFRSOwJXF
Static task
static1
Behavioral task
behavioral1
Sample
a44437840df59ce1bc5e8e62bb30f9e70780cb43e765371c2164a3d7b17c97ba.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
a44437840df59ce1bc5e8e62bb30f9e70780cb43e765371c2164a3d7b17c97ba.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
cobaltstrike
666666
http://api.windowdrive.com:443/jquery-3.3.1.min.js
-
access_type
512
-
beacon_type
2048
-
host
api.windowdrive.com,/jquery-3.3.1.min.js
-
http_header1
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAgUmVmZXJlcjogaHR0cDovL2NvZGUuanF1ZXJ5LmNvbS8AAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADQAAAAIAAAAJX19jZmR1aWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAgUmVmZXJlcjogaHR0cDovL2NvZGUuanF1ZXJ5LmNvbS8AAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADwAAAA0AAAAFAAAACF9fY2ZkdWlkAAAABwAAAAEAAAAPAAAADQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
9472
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\dllhost.exe
-
sc_process64
%windir%\sysnative\dllhost.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCKoLFkFNyJk67EBjQq7yZDZ8xDsRud9B9Wm+v46nVyHAxM5riPaf5hqa9Q15s0HOKHbPbaBxMIywS4Fx9KHb4xVBQ510Webz99G39vWS7p0wrzQdon0MBCl3Z5WUOsjMhb32eOlczMbRuOYWJe5zvNoyCt7aX/HzqBAE3ZsuJR/wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4.234810624e+09
-
unknown2
AAAABAAAAAEAAAXyAAAAAgAAAFQAAAACAAAPWwAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/jquery-3.3.2.min.js
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Safari/537.36
-
watermark
666666
Extracted
cobaltstrike
0
-
watermark
0
Targets
-
-
Target
a44437840df59ce1bc5e8e62bb30f9e70780cb43e765371c2164a3d7b17c97ba.exe
-
Size
482KB
-
MD5
bf8bb1c9ecdf500509da77710ce46e37
-
SHA1
611d9fe71b64e28db13f46b8567e489412a1cc11
-
SHA256
a44437840df59ce1bc5e8e62bb30f9e70780cb43e765371c2164a3d7b17c97ba
-
SHA512
0e126e0da0676cfea7a2495df55ef87d604e7022f46c38eae1e14e5704037a2fa5baec9107ceee832a4228cb19cbe8b1a934379bde47562208ce3b8117e83f46
-
SSDEEP
6144:7ui+uaL5WmwBJA+lxJA1jyxPWIgtij3Hfx4JFHpFO8rgrFREj5nrfO1o3jcaXVr8:qiX7j/A+qjytWL07fCTOlFRSOwJXF
Score10/10 -