General
-
Target
678412c7963488b895a83b6e1d329ed0ccb29c47579cadeb2089525af6e5db24
-
Size
270KB
-
Sample
230909-2h56gaec69
-
MD5
efd963276e4573c8f57867cc279796fc
-
SHA1
ae669878d38468f9ad6780a763b555917354f6da
-
SHA256
678412c7963488b895a83b6e1d329ed0ccb29c47579cadeb2089525af6e5db24
-
SHA512
0108f1142216c7860bfd1c746a9987a60facfa8465fd6576453be7ecd1c30c5b2bb57e418dabb5f2849c1bf70f7e71c8f44b2481d236d3b99ee47944830cd114
-
SSDEEP
3072:RzbINhWl+CIbrqqEVxtfg8jtfDCJS4l9JTFyG+JteEzCnL7zkGIkfhUYJF6vzHk0:RzbUyootfDCvT4ZTXzCLPIk5UDvrKM
Behavioral task
behavioral1
Sample
678412c7963488b895a83b6e1d329ed0ccb29c47579cadeb2089525af6e5db24.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
678412c7963488b895a83b6e1d329ed0ccb29c47579cadeb2089525af6e5db24.dll
Resource
win10v2004-20230831-en
Malware Config
Extracted
cobaltstrike
674054486
http://194.26.29.99:8080/g.pixel
-
access_type
512
-
host
194.26.29.99,/g.pixel
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
8080
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCQHgfQkB3tPFn9jaOJek2TH4eTXH96cpIbhWUyVS/oYjAI6LBgFFf5fLWQqzwA8UBFPJMQcykFkiB0BmvwfqL1a5cPdDJarhZLdWPu/jciG/CrEKd2BGy19TC2K7P9Bv+GQiBsDloGkatUcATgRA4y0JZu6qyzaZRqMSgVDvJJ3QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; InfoPath.2)
-
watermark
674054486
Extracted
cobaltstrike
0
-
watermark
0
Targets
-
-
Target
678412c7963488b895a83b6e1d329ed0ccb29c47579cadeb2089525af6e5db24
-
Size
270KB
-
MD5
efd963276e4573c8f57867cc279796fc
-
SHA1
ae669878d38468f9ad6780a763b555917354f6da
-
SHA256
678412c7963488b895a83b6e1d329ed0ccb29c47579cadeb2089525af6e5db24
-
SHA512
0108f1142216c7860bfd1c746a9987a60facfa8465fd6576453be7ecd1c30c5b2bb57e418dabb5f2849c1bf70f7e71c8f44b2481d236d3b99ee47944830cd114
-
SSDEEP
3072:RzbINhWl+CIbrqqEVxtfg8jtfDCJS4l9JTFyG+JteEzCnL7zkGIkfhUYJF6vzHk0:RzbUyootfDCvT4ZTXzCLPIk5UDvrKM
Score10/10 -