General
-
Target
13e2d9f3b602fb7948f9c7b614a289726190395f865dc6339ca668e6629f1797
-
Size
265KB
-
MD5
41d1139222b976f313d3bbacc91bc0b7
-
SHA1
914365d62d60d228def25849b2dfc6bfaffd6ca9
-
SHA256
13e2d9f3b602fb7948f9c7b614a289726190395f865dc6339ca668e6629f1797
-
SHA512
dda396055c6b0ba9b523542dba0a19b1b99028d18e9f9c6754e441a2387834c31a11955443fedfc92b8390777854034f9cd63a19f85951799d2b36661eb6fd7e
-
SSDEEP
3072:GqqmJwpS2NACV4qAbypuljJGnJYoTjqETdtbsnOfFwXVa/w494YJGaXM5PUHnaH:2mJwpYVNcn3pTdNe+WXVif4uJH
Malware Config
Extracted
cobaltstrike
305419896
http://8.134.157.62:808/dpixel
-
access_type
512
-
host
8.134.157.62,/dpixel
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
polling_time
60000
-
port_number
808
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCZ2cR31XgBMNMwFUsgiH+CK+M7b1i9z8rXRFpt/iICoBrl3Bx/nZABWpT2+yMq0h/KwrEM6qV9T/gv3sqJXu5trZv98LDnZ5izcJmzJ8Mp/3cd8NpWvhGN9eUUzRTvU4LotvYIXLZU7jKHeyV43RnY6XZuSJAMYRhxHxc5knhbuwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENIN)
-
watermark
305419896
Signatures
-
Cobaltstrike family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
13e2d9f3b602fb7948f9c7b614a289726190395f865dc6339ca668e6629f1797
42d123bbf0dac1fc6ab184c122615789
Headers
Imports
Sections