General
-
Target
f08e410d91f4158e43aa204c13ea5f74d209726ad0e82dba02b0e149cab7fc9d
-
Size
3.2MB
-
Sample
231012-lnwk8abc3s
-
MD5
19c339cda54f2d5632c7bd89ea4f3c7b
-
SHA1
26cdc1b86a4f42c75291df7ad84738b60fae50bb
-
SHA256
f08e410d91f4158e43aa204c13ea5f74d209726ad0e82dba02b0e149cab7fc9d
-
SHA512
df03b7b5d9bcbbb27df565fe27d085cd876cffa83420fef0428c81f211bc9f60fa86f242059922761c8b80bb3c5c28a08f9220de34e157dda6e6b8f748593ad1
-
SSDEEP
49152:5xKLvyt0NTN8C8v6djl+uLHvFmRdRgKDRglxnP2AhDPY:3gytUN8CU6djseHvFmRY5FP78
Static task
static1
Behavioral task
behavioral1
Sample
f08e410d91f4158e43aa204c13ea5f74d209726ad0e82dba02b0e149cab7fc9d.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
f08e410d91f4158e43aa204c13ea5f74d209726ad0e82dba02b0e149cab7fc9d.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
cobaltstrike
426352781
http://118.195.159.95:443/match
-
access_type
512
-
beacon_type
2048
-
host
118.195.159.95,/match
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCutewLTFBhkrONlym1XRUsXVY8C6TKqY6LVqDQ61YuSKsGNo1MM/w/JSAZ4YFhPepUH54pZF974aGs1BDTUwgsRyBUem9Nf8pgfQQjJ2TJjuNa84O65R32J94xej9zuj5NnFo1CIRaHOUQkRf9JEWHWK+nWkuX2qrZAu0VQZXTqwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; MASAJS)
-
watermark
426352781
Extracted
cobaltstrike
0
-
watermark
0
Targets
-
-
Target
f08e410d91f4158e43aa204c13ea5f74d209726ad0e82dba02b0e149cab7fc9d
-
Size
3.2MB
-
MD5
19c339cda54f2d5632c7bd89ea4f3c7b
-
SHA1
26cdc1b86a4f42c75291df7ad84738b60fae50bb
-
SHA256
f08e410d91f4158e43aa204c13ea5f74d209726ad0e82dba02b0e149cab7fc9d
-
SHA512
df03b7b5d9bcbbb27df565fe27d085cd876cffa83420fef0428c81f211bc9f60fa86f242059922761c8b80bb3c5c28a08f9220de34e157dda6e6b8f748593ad1
-
SSDEEP
49152:5xKLvyt0NTN8C8v6djl+uLHvFmRdRgKDRglxnP2AhDPY:3gytUN8CU6djseHvFmRY5FP78
Score10/10 -