General
-
Target
d5a56816a74292aa6dfaceca80ee85454ae62d92aad0b1cfaa1f1ecdc87ec9b7
-
Size
265KB
-
MD5
b263f2ffdf7b5022d0b42e32af3b30b9
-
SHA1
897ef0759094c3ad05d6feb0f1e5760ff37d6163
-
SHA256
d5a56816a74292aa6dfaceca80ee85454ae62d92aad0b1cfaa1f1ecdc87ec9b7
-
SHA512
faadd01bcaab03fb6b2d1f94a68b784a9d0927525e715d83eb5e99e238dbabe66e2fa94f521df1d36111c76c3f4e498fe36f9fd3985bbfee1d29d312041d94cd
-
SSDEEP
3072:1q/mJwpS2NACV4qAbypuljJGnJYoTjqETdtbsnOfFwXVa/w494YJGaXM5PUHnaH:KmJwpYVNcn3pTdNe+WXVif4uJH
Malware Config
Extracted
cobaltstrike
305419896
http://8.134.157.62:808/dpixel
-
access_type
512
-
host
8.134.157.62,/dpixel
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
polling_time
60000
-
port_number
808
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCZ2cR31XgBMNMwFUsgiH+CK+M7b1i9z8rXRFpt/iICoBrl3Bx/nZABWpT2+yMq0h/KwrEM6qV9T/gv3sqJXu5trZv98LDnZ5izcJmzJ8Mp/3cd8NpWvhGN9eUUzRTvU4LotvYIXLZU7jKHeyV43RnY6XZuSJAMYRhxHxc5knhbuwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENIN)
-
watermark
305419896
Signatures
-
Cobaltstrike family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
d5a56816a74292aa6dfaceca80ee85454ae62d92aad0b1cfaa1f1ecdc87ec9b7
42d123bbf0dac1fc6ab184c122615789
Headers
Imports
Sections