General
-
Target
LogonFile.exe
-
Size
10.4MB
-
Sample
230809-3pvtragd24
-
MD5
bff3120685dafe9e31206887df290c02
-
SHA1
b0e77766317be53990ff0f3bfc397ea06304a07c
-
SHA256
848323f362252e7704f024c82b362f1c512974b462e1bf8e9e4595464f074bde
-
SHA512
00fa55359b4206b97b4cd45bd0866ff9fd729729827d334945f440b5c44ec5fb37a6dbbdfc0745976e74a2f6d36f9bfa7def9c221430c167c1bd17f23723bd48
-
SSDEEP
49152:JM2fECg63nOYO1rrb/TXvO90d7HjmAFd4A64nsfJvlTUWpGBwCRMq0O4kdgYg9j4:n37D+WzmC8saFioUhvlE1ui5wOM
Static task
static1
Behavioral task
behavioral1
Sample
LogonFile.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
LogonFile.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
cobaltstrike
999999
http://150.158.212.71:80/updates.rss
-
access_type
512
-
host
150.158.212.71,/updates.rss
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
80
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCJgAu3dHVYdCLn6ne76y+JEqMx41gQ1EX2tbelom1ucQjJjH5Qy0kjgIWSQDQ2ZY9FmhbiXaYlSoR68sV92Uf0U4kYdB3HVKIxDi9Cf2st4tqj2qYzRgwUvNr+N3PPq9TMaLqsdSUwLV03bFZlrBpNZU0wV9itFL1+65VzlSzKvQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)
-
watermark
999999
Extracted
cobaltstrike
0
-
watermark
0
Targets
-
-
Target
LogonFile.exe
-
Size
10.4MB
-
MD5
bff3120685dafe9e31206887df290c02
-
SHA1
b0e77766317be53990ff0f3bfc397ea06304a07c
-
SHA256
848323f362252e7704f024c82b362f1c512974b462e1bf8e9e4595464f074bde
-
SHA512
00fa55359b4206b97b4cd45bd0866ff9fd729729827d334945f440b5c44ec5fb37a6dbbdfc0745976e74a2f6d36f9bfa7def9c221430c167c1bd17f23723bd48
-
SSDEEP
49152:JM2fECg63nOYO1rrb/TXvO90d7HjmAFd4A64nsfJvlTUWpGBwCRMq0O4kdgYg9j4:n37D+WzmC8saFioUhvlE1ui5wOM
Score10/10 -