General
-
Target
d5298e8e64fd075a7b1b59e2f8f13d0101538f9d637b94f95dad2cf9d95bb007
-
Size
254KB
-
Sample
230805-ja64pacc8z
-
MD5
271d3cba0f49cb5cd73752ef0762c71b
-
SHA1
86fe6c9e32f37913eb299a71f91ddfad2218fbc6
-
SHA256
d5298e8e64fd075a7b1b59e2f8f13d0101538f9d637b94f95dad2cf9d95bb007
-
SHA512
0015ac389df936321bfcdc942ca7b5f957b8b53b84883ee3fc86094d3dd3fb7fd56c8285290ad29dbe99efd17ae16fed4269de493f7328309bdbdbada67508ef
-
SSDEEP
3072:TG8Ym2ZsTMcKlm8dTNtdF2N9HuORJJRfnqLTnbk9w9G3sO4Vb494YJGaXM4SHnaH:TG8JOLT3CNTj6TnwissOqq4uWH
Behavioral task
behavioral1
Sample
d5298e8e64fd075a7b1b59e2f8f13d0101538f9d637b94f95dad2cf9d95bb007.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
d5298e8e64fd075a7b1b59e2f8f13d0101538f9d637b94f95dad2cf9d95bb007.dll
Resource
win10v2004-20230703-en
Malware Config
Extracted
cobaltstrike
305419896
http://95.141.41.29:401/ga.js
-
access_type
512
-
host
95.141.41.29,/ga.js
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
polling_time
60000
-
port_number
401
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCRUqGnXw+X1H/ma7wfXeXRX4CHCL/OsunsOwBMLzvbFSKyxZNpPzrYPc+iZKekZjtQJtEKx1ihqkdIsktGVMzbjokJi4/yggIA6bVTbMVXtkBNvxpMQ9kTz+JHmUA8HsZLswpkSrwz6gAKWc6oqF4BYG4N5+EPFdcl97bE4Mi9lQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; MDDCJS)
-
watermark
305419896
Targets
-
-
Target
d5298e8e64fd075a7b1b59e2f8f13d0101538f9d637b94f95dad2cf9d95bb007
-
Size
254KB
-
MD5
271d3cba0f49cb5cd73752ef0762c71b
-
SHA1
86fe6c9e32f37913eb299a71f91ddfad2218fbc6
-
SHA256
d5298e8e64fd075a7b1b59e2f8f13d0101538f9d637b94f95dad2cf9d95bb007
-
SHA512
0015ac389df936321bfcdc942ca7b5f957b8b53b84883ee3fc86094d3dd3fb7fd56c8285290ad29dbe99efd17ae16fed4269de493f7328309bdbdbada67508ef
-
SSDEEP
3072:TG8Ym2ZsTMcKlm8dTNtdF2N9HuORJJRfnqLTnbk9w9G3sO4Vb494YJGaXM4SHnaH:TG8JOLT3CNTj6TnwissOqq4uWH
Score3/10 -