General
-
Target
5d5e8997e40b5ea9007dfdcdbb52badaa5da5158a809b16a5400550e58f9dca7
-
Size
260KB
-
Sample
231020-v2pt9sga52
-
MD5
212da2391332890eb8b15e01a9e972a6
-
SHA1
b28aec20da55c150b2b9c5ff33ac14f798db5d8f
-
SHA256
5d5e8997e40b5ea9007dfdcdbb52badaa5da5158a809b16a5400550e58f9dca7
-
SHA512
d50c3aecc5a6b37c7750839ee96b09fb981e5f4ada67d5c1d9769ee6963f71a9a82d60581a0b1ac7ce0129899892d35123244237fb70c454aaf3b111ed9c3bce
-
SSDEEP
3072:7c0nsHpyvGj346lbkBN/gppj8aJGIhxjT3A8ygbLAZmitdGlNl9tQYJ1b/S1PMRZ:7c0bPzIpt8ahTw8PHA8itQdQv4uE
Behavioral task
behavioral1
Sample
5d5e8997e40b5ea9007dfdcdbb52badaa5da5158a809b16a5400550e58f9dca7.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
5d5e8997e40b5ea9007dfdcdbb52badaa5da5158a809b16a5400550e58f9dca7.dll
Resource
win10v2004-20230915-en
Malware Config
Extracted
cobaltstrike
426352781
http://43.138.47.181:3344/cx
-
access_type
512
-
host
43.138.47.181,/cx
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
3344
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCgxul8nNgzRh4LDSFMYIu3p65qg9Va4T/ChBiVjIQ0422Ad/t3yhkj6sBmmmdSVVClcabuVwETc68GfrO8OIO0Lh9J+zSzChnS28qbQV4wXA10//1EbPLuDXVCz1zzSjf/zY6zeSSXksUK0vc6wVVr3Bu8cwWPbDF67P3viIGYYwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)
-
watermark
426352781
Targets
-
-
Target
5d5e8997e40b5ea9007dfdcdbb52badaa5da5158a809b16a5400550e58f9dca7
-
Size
260KB
-
MD5
212da2391332890eb8b15e01a9e972a6
-
SHA1
b28aec20da55c150b2b9c5ff33ac14f798db5d8f
-
SHA256
5d5e8997e40b5ea9007dfdcdbb52badaa5da5158a809b16a5400550e58f9dca7
-
SHA512
d50c3aecc5a6b37c7750839ee96b09fb981e5f4ada67d5c1d9769ee6963f71a9a82d60581a0b1ac7ce0129899892d35123244237fb70c454aaf3b111ed9c3bce
-
SSDEEP
3072:7c0nsHpyvGj346lbkBN/gppj8aJGIhxjT3A8ygbLAZmitdGlNl9tQYJ1b/S1PMRZ:7c0bPzIpt8ahTw8PHA8itQdQv4uE
Score1/10 -