General
-
Target
e72f8eb2629b3a92e0108aaf90b0ccf25a2a2117d2ea14df0b24bb314382be35
-
Size
208KB
-
Sample
231020-gtqvpsga62
-
MD5
28fa796a706ea75cd6dda75221341905
-
SHA1
de7618358caa1a87e4ffd47705ba765d3feb8a73
-
SHA256
e72f8eb2629b3a92e0108aaf90b0ccf25a2a2117d2ea14df0b24bb314382be35
-
SHA512
d2a1fb33bf3994d524a6154d90fd84a320066ece9c4e94f70a192eb81d2ae4bc6e8edc0b6d442b2db64130663db3f265ffc89261be159dcf77a59ef492af497b
-
SSDEEP
3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUovY59:LIDff9D8C6XYRw6MT2DEjV
Behavioral task
behavioral1
Sample
e72f8eb2629b3a92e0108aaf90b0ccf25a2a2117d2ea14df0b24bb314382be35.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
e72f8eb2629b3a92e0108aaf90b0ccf25a2a2117d2ea14df0b24bb314382be35.dll
Resource
win10v2004-20230915-en
Malware Config
Extracted
cobaltstrike
100000
http://119.23.240.31:15028/g.pixel
-
access_type
512
-
host
119.23.240.31,/g.pixel
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
15028
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCsqbUYjd6rwlaY0WZDe5voNXyHfeoqf8+dOtuIUu4+JQMdTwmlm3CUnwWcBm/N6+QeLrZnVwPYrp+Tz6OcGdZntU80uFjdn8X/uwALOQjz3LXFM7A5jNnDxvraqGMf9ST/2KbV8SR8/O+7jt8KsgQ7L3InRRdLcLnOtxxIX3TS7QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)
-
watermark
100000
Targets
-
-
Target
e72f8eb2629b3a92e0108aaf90b0ccf25a2a2117d2ea14df0b24bb314382be35
-
Size
208KB
-
MD5
28fa796a706ea75cd6dda75221341905
-
SHA1
de7618358caa1a87e4ffd47705ba765d3feb8a73
-
SHA256
e72f8eb2629b3a92e0108aaf90b0ccf25a2a2117d2ea14df0b24bb314382be35
-
SHA512
d2a1fb33bf3994d524a6154d90fd84a320066ece9c4e94f70a192eb81d2ae4bc6e8edc0b6d442b2db64130663db3f265ffc89261be159dcf77a59ef492af497b
-
SSDEEP
3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUovY59:LIDff9D8C6XYRw6MT2DEjV
Score3/10 -