General

  • Target
    b64-2-xord.dll
  • Size 254KB
  • Sample230819-tgeccsch4y
  • SHA256 7ad79f28a7e10df617a55f85d379949f65fa30770966d889d899c94734e24cca
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cobaltstrike

Botnet
  • 2126429048

C2
  • http://67.207.93.135:80/metro91/admin/1/ppptp.jpg

Attributes
  • access_type

    512

  • host

    67.207.93.135,/metro91/admin/1/ppptp.jpg

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAARQ29ubmVjdGlvbjogQ2xvc2UAAAAQAAAAHkhvc3Q6IG1haGFtYXlhMWlmZXNjaWVuY2VzLmNvbQAAAAoAAAAXQ2FjaGUtQ29udHJvbDogbm8tY2FjaGUAAAAHAAAAAAAAAAMAAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29ubmVjdGlvbjogS2VlcC1BbGl2ZQAAABAAAAAeSG9zdDogbWFoYW1heWExaWZlc2NpZW5jZXMuY29tAAAACgAAABdDYWNoZS1Db250cm9sOiBuby1jYWNoZQAAAAcAAAAAAAAACAAAAAUAAAACaWQAAAAHAAAAAQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    1280

  • maxdns

    255

  • polling_time

    30000

  • port_number

    80

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDVEWupXLqhGMw+U/ChoDycqpf3CqF4PfAxC6Gs7HpoYtM2UIDS2rAO7hTYnCVRSWh0LTBqpQ1RHyNgfK8tBDsBQ8yEp5yxZYj0BWqGlIlSi0OG/x1JhZa41C0DlSElY2LyXLB3c/RuyQKHv+arhulVDrdAuIhGVQt0C4PghQu8IQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /metro91/admin/1/secure.php

  • user_agent

    Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)

  • watermark

    2126429048

Signatures

  • Cobaltstrike family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • b64-2-xord.dll
    .dll 254KB

b64-2-xord.dll

  • IMPHASH 39a613f0d59cc3ef3bbadfe701521e7c
  • SHA256 7ad79f28a7e10df617a55f85d379949f65fa30770966d889d899c94734e24cca
  • MD5 SHA1 SHA512 SSDEEP
  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
Major OS version
Entry point
93589
Magic Number
523
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_SYSTEM IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI
PDB paths