General
-
Target
ab879f147981ac15cff29f9c8f803babd24fcbe0af35ff41506cac63568af683
-
Size
12KB
-
Sample
230823-ahk2rahh8x
-
MD5
1a51a2e70bf4d5ea2d0cc63c699d02e4
-
SHA1
7660b14ab75b8c001e8ea4552368f1cb2e4e2343
-
SHA256
ab879f147981ac15cff29f9c8f803babd24fcbe0af35ff41506cac63568af683
-
SHA512
47df2439bf8895afd0e174bba2e61a339dd8acaaa1571373218670e033f12d629d923ee8bddc1ce6cce17399b68ee156a77de99bb90a0db7750d7df1a14af490
-
SSDEEP
192:v1ywrfiRD3UXIlsEAatUdSRdzHUPnXBdwdRdzHsDLMN/PeH:vliRQdEAat0SrITwdrDSrH
Malware Config
Extracted
cobaltstrike
http://185.224.169.210:8087/rLKT
-
user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; LBBROWSER)
Extracted
cobaltstrike
1234567890
http://185.224.169.210:8087/g.pixel
-
access_type
512
-
host
185.224.169.210,/g.pixel
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
8087
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCInckoVkZch8zxEFBpo+m0RapatbLO+qncrtLCMQ5n2Wa9zPpPNfh2nwsvtCDzf1Uq711AmyaU3ReSGU4kTXozGrIFDwhAE6vApFWv7Z4SQYJxrZVSBw68Vgg7wlLBI1QliL6SZFkbYF8CmT6kNxs66V6P3M9WcWPwG6htVkOfHwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; 360space)
-
watermark
1234567890
Extracted
cobaltstrike
0
-
watermark
0
Targets
-
-
Target
ab879f147981ac15cff29f9c8f803babd24fcbe0af35ff41506cac63568af683
-
Size
12KB
-
MD5
1a51a2e70bf4d5ea2d0cc63c699d02e4
-
SHA1
7660b14ab75b8c001e8ea4552368f1cb2e4e2343
-
SHA256
ab879f147981ac15cff29f9c8f803babd24fcbe0af35ff41506cac63568af683
-
SHA512
47df2439bf8895afd0e174bba2e61a339dd8acaaa1571373218670e033f12d629d923ee8bddc1ce6cce17399b68ee156a77de99bb90a0db7750d7df1a14af490
-
SSDEEP
192:v1ywrfiRD3UXIlsEAatUdSRdzHUPnXBdwdRdzHsDLMN/PeH:vliRQdEAat0SrITwdrDSrH
Score10/10-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Blocklisted process makes network request
-