General
-
Target
f2ad455f344f32c80db9ebd8473e792ee468d1343589787b5b4c1172d6f17591
-
Size
7.8MB
-
Sample
230923-fpxl1scg6t
-
MD5
563174eb0fc58ab02e0ffbd3657b5956
-
SHA1
90960817733c0ad9c38674632fab375c16803085
-
SHA256
f2ad455f344f32c80db9ebd8473e792ee468d1343589787b5b4c1172d6f17591
-
SHA512
9422f325f6684b14e6ace2626ef9920893ee4f09f00999e3a0501408537f5e49f92176bebf0fa31cecb0dd78a8d112a467528a3e0ca271492f7b06bb5fae0681
-
SSDEEP
196608:/qciIE7SRpoOQXMyH9onJ5hrZEnhbJMFjfWPZYiuFIJCq+A:JiIE7YojcyH9c5hlEnhyFzWPZYYC
Behavioral task
behavioral1
Sample
f2ad455f344f32c80db9ebd8473e792ee468d1343589787b5b4c1172d6f17591.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
f2ad455f344f32c80db9ebd8473e792ee468d1343589787b5b4c1172d6f17591.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
cobaltstrike
http://1.116.127.12:9999/wFZF
-
user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)
Extracted
cobaltstrike
100000
http://1.116.127.12:9999/dpixel
-
access_type
512
-
host
1.116.127.12,/dpixel
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
9999
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCYlWof3phxyz7RiiFjZh8lfZSbNe/iYAtSdqLEn+dPX3IqyMyw31PFB5hrXbmSE0NOhkyIs/RSO2NmWFhmAe6Zr41TyvSCXMBEpmjyPHA8KAw5ikTDLwaSmAI+wWwHsYSGJTZHx0avH7FrSMfgZEPF+31x7MktGO6YrnAgCEBr5QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; MAAU; NP08)
-
watermark
100000
Extracted
cobaltstrike
0
-
watermark
0
Targets
-
-
Target
f2ad455f344f32c80db9ebd8473e792ee468d1343589787b5b4c1172d6f17591
-
Size
7.8MB
-
MD5
563174eb0fc58ab02e0ffbd3657b5956
-
SHA1
90960817733c0ad9c38674632fab375c16803085
-
SHA256
f2ad455f344f32c80db9ebd8473e792ee468d1343589787b5b4c1172d6f17591
-
SHA512
9422f325f6684b14e6ace2626ef9920893ee4f09f00999e3a0501408537f5e49f92176bebf0fa31cecb0dd78a8d112a467528a3e0ca271492f7b06bb5fae0681
-
SSDEEP
196608:/qciIE7SRpoOQXMyH9onJ5hrZEnhbJMFjfWPZYiuFIJCq+A:JiIE7YojcyH9c5hlEnhyFzWPZYYC
Score10/10-
Loads dropped DLL
-