Overview

overview

10

Static

static

10

b64-2-xord.dll

windows7-x64

1

b64-2-xord.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    b64-2-xord.dll

  • Size

    254KB

  • MD5

    4a82732a29459d7b81bb53c8f1a778e5

  • SHA1

    09cfec9d530cf471423fc062f21ddf23d29a04c7

  • SHA256

    7ad79f28a7e10df617a55f85d379949f65fa30770966d889d899c94734e24cca

  • SHA512

    ea390a2c8eb55925880ba7d7e770b1a62e8bd7eee3b9c32309a3412d8adbd779811623fb4913e75447ae0f5f400bae0e011ad0732b19263022448362bd0e330e

  • SSDEEP

    3072:mJwpS2NACV4qAbypuljJGnJYoTjqETdtbsnOfFwXVa/o494YJGaXMXhwHnaHL:mJwpYVNcn3pTdNe+WXVin4utHk

Score
10/10
2126429048cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

2126429048

C2

http://67.207.93.135:80/metro91/admin/1/ppptp.jpg

Attributes
  • access_type

    512

  • host

    67.207.93.135,/metro91/admin/1/ppptp.jpg

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAARQ29ubmVjdGlvbjogQ2xvc2UAAAAQAAAAHkhvc3Q6IG1haGFtYXlhMWlmZXNjaWVuY2VzLmNvbQAAAAoAAAAXQ2FjaGUtQ29udHJvbDogbm8tY2FjaGUAAAAHAAAAAAAAAAMAAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29ubmVjdGlvbjogS2VlcC1BbGl2ZQAAABAAAAAeSG9zdDogbWFoYW1heWExaWZlc2NpZW5jZXMuY29tAAAACgAAABdDYWNoZS1Db250cm9sOiBuby1jYWNoZQAAAAcAAAAAAAAACAAAAAUAAAACaWQAAAAHAAAAAQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    1280

  • maxdns

    255

  • polling_time

    30000

  • port_number

    80

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDVEWupXLqhGMw+U/ChoDycqpf3CqF4PfAxC6Gs7HpoYtM2UIDS2rAO7hTYnCVRSWh0LTBqpQ1RHyNgfK8tBDsBQ8yEp5yxZYj0BWqGlIlSi0OG/x1JhZa41C0DlSElY2LyXLB3c/RuyQKHv+arhulVDrdAuIhGVQt0C4PghQu8IQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /metro91/admin/1/secure.php

  • user_agent

    Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)

  • watermark

    2126429048

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • b64-2-xord.dll
    .dll windows x64

    39a613f0d59cc3ef3bbadfe701521e7c


    Headers

    Imports

    Exports

    Sections