Overview

overview

10

Static

static

10

34b24c790f...2c.dll

windows7-x64

1

34b24c790f...2c.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    34b24c790fb2cedbe00baab4c8d4c652ea339b76b25fcac9c9e8f0cf46a8a72c

  • Size

    256KB

  • Sample

    230813-ceqh6sgd55

  • MD5

    ee7683d1bfd17ea6cb096313a7e6e061

  • SHA1

    e566e54dfd7d909d6dcdf08d3cbaaeef065d06eb

  • SHA256

    34b24c790fb2cedbe00baab4c8d4c652ea339b76b25fcac9c9e8f0cf46a8a72c

  • SHA512

    313a5b612decc13398e97def4613d56120abf0693ff8cd4bd1661f04bd56c39d2ab9df816499866fcd29e2085f611cec69f085e50719044768101f4cdb2b2005

  • SSDEEP

    3072:7c0nsHpyvGj346lbkBN/gp7j8aJGIhxjT3A8ygbLAZmitdGlv9tQYJ1b/S1PG8VE:7c0bPzIpf8ahTw8PHA8itQxQvuuE

Score
10/10
cobaltstrike1

Malware Config

Extracted

Family

cobaltstrike

Botnet

1

C2

http://149.129.72.37:8880/dot.gif

Attributes
  • access_type

    512

  • host

    149.129.72.37,/dot.gif

  • http_header1

    AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • polling_time

    60000

  • port_number

    8880

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDS/rlJeDQ7fUDVPHwzoSY1aOE51RF8i623vgA9AHFXM7z6vMoxirPHKZf0HWm+EC+fLfMynKXpl5WvLDf1EtiIlkZA0YZTaSI7EEQV41+9j+TDw49WPrEAOSBvd7IWOf6Xx21yTbv5t8oOtslTAIRM46VJopviiaesKZTAhQdHhQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit.php

  • user_agent

    Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUSSEM)

  • watermark

    1

Targets

    • Target

      34b24c790fb2cedbe00baab4c8d4c652ea339b76b25fcac9c9e8f0cf46a8a72c

    • Size

      256KB

    • MD5

      ee7683d1bfd17ea6cb096313a7e6e061

    • SHA1

      e566e54dfd7d909d6dcdf08d3cbaaeef065d06eb

    • SHA256

      34b24c790fb2cedbe00baab4c8d4c652ea339b76b25fcac9c9e8f0cf46a8a72c

    • SHA512

      313a5b612decc13398e97def4613d56120abf0693ff8cd4bd1661f04bd56c39d2ab9df816499866fcd29e2085f611cec69f085e50719044768101f4cdb2b2005

    • SSDEEP

      3072:7c0nsHpyvGj346lbkBN/gp7j8aJGIhxjT3A8ygbLAZmitdGlv9tQYJ1b/S1PG8VE:7c0bPzIpf8ahTw8PHA8itQxQvuuE

    Score
    3/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks