General
-
Target
56db0b88387361d99d5ecba40a9826b0fc4736164d281f39bf80aef5ef4852a8
-
Size
11.4MB
-
Sample
230829-pkqgksfd7y
-
MD5
4b39771a52bb7f7dd0f9534e69d305fe
-
SHA1
2ff6649bd040125cb21e515e54cbc4ed7746b22a
-
SHA256
56db0b88387361d99d5ecba40a9826b0fc4736164d281f39bf80aef5ef4852a8
-
SHA512
7d13c2f50e31bb08448546327c680fc714ff30a8023fcc54bfeff5799649d8dd7a539c7f187089e30f19d4f0eb436a195c894478265b285db334d2a3a8be63eb
-
SSDEEP
196608:2Kmd3/4PpFf+/OBwA8pJsv6tWKFdu9C047:BsQXiA8pJsv6tWKFdu9Cv
Static task
static1
Behavioral task
behavioral1
Sample
56db0b88387361d99d5ecba40a9826b0fc4736164d281f39bf80aef5ef4852a8.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
56db0b88387361d99d5ecba40a9826b0fc4736164d281f39bf80aef5ef4852a8.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
metasploit
windows/download_exec
http://101.34.249.226:9999/kZMJ
- headers User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0)
Extracted
cobaltstrike
305419896
http://101.34.249.226:9999/activity
-
access_type
512
-
host
101.34.249.226,/activity
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
polling_time
60000
-
port_number
9999
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDZTMEiq7tDYFZT1y04dlK4lZ5U4vGGqmLRoib/IG+XX5Jq4Un/Soz/reE0+Uqc/kzL7LANjxqMnX0y4HEO6MHFzfyjwL1d9yUWBxhiV6qtDJAnyiySYBQaCzrPmYQe651zB5mlCj1AIMPs+Rms56cLRLdZwPbwaLkmEqh1PcZWYQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
-
watermark
305419896
Targets
-
-
Target
56db0b88387361d99d5ecba40a9826b0fc4736164d281f39bf80aef5ef4852a8
-
Size
11.4MB
-
MD5
4b39771a52bb7f7dd0f9534e69d305fe
-
SHA1
2ff6649bd040125cb21e515e54cbc4ed7746b22a
-
SHA256
56db0b88387361d99d5ecba40a9826b0fc4736164d281f39bf80aef5ef4852a8
-
SHA512
7d13c2f50e31bb08448546327c680fc714ff30a8023fcc54bfeff5799649d8dd7a539c7f187089e30f19d4f0eb436a195c894478265b285db334d2a3a8be63eb
-
SSDEEP
196608:2Kmd3/4PpFf+/OBwA8pJsv6tWKFdu9C047:BsQXiA8pJsv6tWKFdu9Cv
Score10/10-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-