General
-
Target
JC_54bf792ecd3f2277900c4fc2334845141557de8aecf06e45405853201a2f8d57
-
Size
5.3MB
-
Sample
230906-vbkgvshg7t
-
MD5
ae23bf5bb19867202a1bf2c7fc097af3
-
SHA1
e7313b580d1867ba9481cec80bd39964e8c10362
-
SHA256
54bf792ecd3f2277900c4fc2334845141557de8aecf06e45405853201a2f8d57
-
SHA512
f1ccee7b6207740991e2ae546e0466d701026853f636a390c959d500ec578671e23fcc1f107b6619b24ddc4cced76fa650004f41f59b73859f0eedd5bfa5a8f6
-
SSDEEP
49152:yFVerG3/pNsiBI085Nz1Ff9hfkC9mEBnWxp8Iy3bfAjOUZEfA20h86JJ2H8xqtTz:yNp6ZN5pLrhWxp8wZwx/SLGs/e/
Static task
static1
Behavioral task
behavioral1
Sample
JC_54bf792ecd3f2277900c4fc2334845141557de8aecf06e45405853201a2f8d57.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
JC_54bf792ecd3f2277900c4fc2334845141557de8aecf06e45405853201a2f8d57.exe
Resource
win10v2004-20230831-en
Malware Config
Extracted
cobaltstrike
100000
http://124.222.166.63:44332/j.ad
-
access_type
512
-
host
124.222.166.63,/j.ad
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
44332
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtVCAQ+ZyOmUge1b3TFO4jmi59G7l1PNK7d6ftXPG7sJcevPtp4wPmazXMMFyvUvg+CPltfdrtyk628qFiwNQOs53fxT8/vQatiVQaZr5n9E73RZApYA1m5be4oJAvMClrdo6/oejps5xAW9GBqQB2COAi5mQ3/ElBkmuBaSisCQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; Xbox)
-
watermark
100000
Extracted
cobaltstrike
0
-
watermark
0
Targets
-
-
Target
JC_54bf792ecd3f2277900c4fc2334845141557de8aecf06e45405853201a2f8d57
-
Size
5.3MB
-
MD5
ae23bf5bb19867202a1bf2c7fc097af3
-
SHA1
e7313b580d1867ba9481cec80bd39964e8c10362
-
SHA256
54bf792ecd3f2277900c4fc2334845141557de8aecf06e45405853201a2f8d57
-
SHA512
f1ccee7b6207740991e2ae546e0466d701026853f636a390c959d500ec578671e23fcc1f107b6619b24ddc4cced76fa650004f41f59b73859f0eedd5bfa5a8f6
-
SSDEEP
49152:yFVerG3/pNsiBI085Nz1Ff9hfkC9mEBnWxp8Iy3bfAjOUZEfA20h86JJ2H8xqtTz:yNp6ZN5pLrhWxp8wZwx/SLGs/e/
Score10/10 -