General
-
Target
020852ac13c272d2033bb12acc67838d417a620bdebc8153c8aa32d82b24efc3
-
Size
208KB
-
Sample
230929-cxaknsgg67
-
MD5
6f8e32c572cdef46e506a1577f3cc752
-
SHA1
bee22a9384e1623310e027be6eab2d9781ac5966
-
SHA256
020852ac13c272d2033bb12acc67838d417a620bdebc8153c8aa32d82b24efc3
-
SHA512
1f19280e91433130d5845c312a76944aa99ee28da4fe7580f6e3d5b8b62c5377b019242dff60aaa6375b701c9579ee4e1dde53b6e468b3ca3ad7d631297b2f9d
-
SSDEEP
3072:aI6CqRCxffkClDn7LQlRw6x+Y3CxT2DtK5jdUfY5w:aIDff9NXYRw6MT2DEj
Behavioral task
behavioral1
Sample
020852ac13c272d2033bb12acc67838d417a620bdebc8153c8aa32d82b24efc3.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
020852ac13c272d2033bb12acc67838d417a620bdebc8153c8aa32d82b24efc3.dll
Resource
win10v2004-20230915-en
Malware Config
Extracted
cobaltstrike
100000
http://192.168.84.1:8080/__utm.gif
-
access_type
512
-
host
192.168.84.1,/__utm.gif
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
8080
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCbR9DNuWRVZuUF0/UoJnVwbN+BKOedxFYmzGqMua//T0DzRpqfEcIRILnW6V8a3ggQHLKYvYQGL6tbGa5mBOeaOEfjot/Jwo0AWF45uMtknuyobCsrpKbhidSn6YPS0K4bJukOPS/wec2ooZI3AgT52MLI76GB11ezozPItYOYhQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
-
watermark
100000
Targets
-
-
Target
020852ac13c272d2033bb12acc67838d417a620bdebc8153c8aa32d82b24efc3
-
Size
208KB
-
MD5
6f8e32c572cdef46e506a1577f3cc752
-
SHA1
bee22a9384e1623310e027be6eab2d9781ac5966
-
SHA256
020852ac13c272d2033bb12acc67838d417a620bdebc8153c8aa32d82b24efc3
-
SHA512
1f19280e91433130d5845c312a76944aa99ee28da4fe7580f6e3d5b8b62c5377b019242dff60aaa6375b701c9579ee4e1dde53b6e468b3ca3ad7d631297b2f9d
-
SSDEEP
3072:aI6CqRCxffkClDn7LQlRw6x+Y3CxT2DtK5jdUfY5w:aIDff9NXYRw6MT2DEj
Score3/10 -