General
-
Target
b0623b791beaec60b99d2d3f2d03c31e2a3bbe18ea1e78c4bc60b4115f8e920c
-
Size
208KB
-
Sample
231024-d4v1macb22
-
MD5
c0c9e8493ac55c1d1d66eba7adf4c449
-
SHA1
32a5c25bcc793f48f2cf20620da298f4bc52e118
-
SHA256
b0623b791beaec60b99d2d3f2d03c31e2a3bbe18ea1e78c4bc60b4115f8e920c
-
SHA512
b1f9e0b3fedeb80efe2385691a2b8682beaef87e25c38eeb6cd9040dccacd7c4ec25cf33f3869e7a6ab6585fa0d34eddb882050fa0e1d36f7971c63adaaa2b1d
-
SSDEEP
3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdU/Y5K:LIDff9D8C6XYRw6MT2DEj
Behavioral task
behavioral1
Sample
b0623b791beaec60b99d2d3f2d03c31e2a3bbe18ea1e78c4bc60b4115f8e920c.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
b0623b791beaec60b99d2d3f2d03c31e2a3bbe18ea1e78c4bc60b4115f8e920c.dll
Resource
win10v2004-20231023-en
Malware Config
Extracted
cobaltstrike
100000
http://154.221.17.44:2090/j.ad
-
access_type
512
-
host
154.221.17.44,/j.ad
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
2090
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCCr0JO14KAgWUPhMv2XrwFSPo2Q5vhqWwFISqe5qoU5RCVGLhVCFrwsFiZbw6OCT7LdLRXaEeqs8s6jP04wP80iAi3MCk0yitDWWVMi8zRwYDVtsP9AImfqem525DCuOe9RVZ3+0k6/QgUCKtcg6V1/5aJNq9B5+Xk5FICmpLaMwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; MALC)
-
watermark
100000
Targets
-
-
Target
b0623b791beaec60b99d2d3f2d03c31e2a3bbe18ea1e78c4bc60b4115f8e920c
-
Size
208KB
-
MD5
c0c9e8493ac55c1d1d66eba7adf4c449
-
SHA1
32a5c25bcc793f48f2cf20620da298f4bc52e118
-
SHA256
b0623b791beaec60b99d2d3f2d03c31e2a3bbe18ea1e78c4bc60b4115f8e920c
-
SHA512
b1f9e0b3fedeb80efe2385691a2b8682beaef87e25c38eeb6cd9040dccacd7c4ec25cf33f3869e7a6ab6585fa0d34eddb882050fa0e1d36f7971c63adaaa2b1d
-
SSDEEP
3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdU/Y5K:LIDff9D8C6XYRw6MT2DEj
Score3/10 -