General
-
Target
5fd343d172f0b304a03edf829b5773685bdc83183df8fcaa6b72249b70319839
-
Size
256KB
-
Sample
231022-jvvldsgb75
-
MD5
083802946e3cdeab24457a0390d17d3c
-
SHA1
feaafac835f7d9af40c246c9d05329c5320aa51d
-
SHA256
5fd343d172f0b304a03edf829b5773685bdc83183df8fcaa6b72249b70319839
-
SHA512
56b670fe5de3cc7efaa7ccc675e50ee59c6f01ec2b80e2a8d3a755f13324a228e444bddf076164a0a05dd002cad62fe66642d1ab2fb95b11c5cdee924aa8088f
-
SSDEEP
3072:7c0nsHpyvGj346lbkBN/gppj8aJGIhxjT3A8ygbLAZmitdGl89tQYJ1b/S1PMZ8C:7c0bPzIpt8ahTw8PHA8itQEQvquE
Behavioral task
behavioral1
Sample
5fd343d172f0b304a03edf829b5773685bdc83183df8fcaa6b72249b70319839.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
5fd343d172f0b304a03edf829b5773685bdc83183df8fcaa6b72249b70319839.dll
Resource
win10v2004-20231020-en
Malware Config
Extracted
cobaltstrike
426352781
http://175.178.5.19:6969/load
-
access_type
512
-
host
175.178.5.19,/load
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
6969
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCDtjQ9ATFF+irPMf2sJS+bY8ftEPkDSuAyRGxKJM2THgBrWDqPz8Lpxc3U64O4CFQZx6ukiljhyU6zV+nau91LD2dofaAKkkmaRbxrC1vONPcioKg2MnEkWgLDtB9rFJubP69r7td8gZbH0SWKOkDQVGjD+LJStDFL6H06DJ68CQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; BOIE9;ENUS)
-
watermark
426352781
Targets
-
-
Target
5fd343d172f0b304a03edf829b5773685bdc83183df8fcaa6b72249b70319839
-
Size
256KB
-
MD5
083802946e3cdeab24457a0390d17d3c
-
SHA1
feaafac835f7d9af40c246c9d05329c5320aa51d
-
SHA256
5fd343d172f0b304a03edf829b5773685bdc83183df8fcaa6b72249b70319839
-
SHA512
56b670fe5de3cc7efaa7ccc675e50ee59c6f01ec2b80e2a8d3a755f13324a228e444bddf076164a0a05dd002cad62fe66642d1ab2fb95b11c5cdee924aa8088f
-
SSDEEP
3072:7c0nsHpyvGj346lbkBN/gppj8aJGIhxjT3A8ygbLAZmitdGl89tQYJ1b/S1PMZ8C:7c0bPzIpt8ahTw8PHA8itQEQvquE
Score1/10 -