General
-
Target
84ba52d72e556839a9d74535b2717a106f9984f834cf73ed5a6c8efd2cc771ba
-
Size
205KB
-
Sample
231025-jx55xafc23
-
MD5
50612131923d1dc80f57a0f727b0efe6
-
SHA1
f7f3205ec75e5d45b80ae021944faeda4784d446
-
SHA256
84ba52d72e556839a9d74535b2717a106f9984f834cf73ed5a6c8efd2cc771ba
-
SHA512
5a2ef9c24d7457cb091a87623fb607ba6c01ba3a1bbf0fb8ad982b50b6ab80d8ae720c1e0b9a9ad52815bfc473ba647fe7bbd3c8f0774c831d9c38fa755b35e1
-
SSDEEP
3072:v/QPFX1eqEfuBNSYuiM8CNj8hFsoMX0ghsJRgCD3iFw9jdUA50Z:v/MEfuN0t8C5oFsoeRM3o0jG
Behavioral task
behavioral1
Sample
84ba52d72e556839a9d74535b2717a106f9984f834cf73ed5a6c8efd2cc771ba.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
84ba52d72e556839a9d74535b2717a106f9984f834cf73ed5a6c8efd2cc771ba.dll
Resource
win10v2004-20231023-en
Malware Config
Extracted
cobaltstrike
426352781
http://192.168.233.110:80/push
-
access_type
512
-
host
192.168.233.110,/push
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
80
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDHwo3jJJw0Vz43DrYL9RixElpmaqjEqghEcZT+JcGKIHS03YQm//30ogFMUjhCmg0gZLj2rgzpXb4l/7AxpGB3g89ZPkVuNzjWZrJtoLVhfuaouLapQ6luBJhc9wGwB5o+cimB4RNnqaX5t9OWdFB01bFfB42wk/i+S4ULGt0R5QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; BOIE9;ENUS)
-
watermark
426352781
Targets
-
-
Target
84ba52d72e556839a9d74535b2717a106f9984f834cf73ed5a6c8efd2cc771ba
-
Size
205KB
-
MD5
50612131923d1dc80f57a0f727b0efe6
-
SHA1
f7f3205ec75e5d45b80ae021944faeda4784d446
-
SHA256
84ba52d72e556839a9d74535b2717a106f9984f834cf73ed5a6c8efd2cc771ba
-
SHA512
5a2ef9c24d7457cb091a87623fb607ba6c01ba3a1bbf0fb8ad982b50b6ab80d8ae720c1e0b9a9ad52815bfc473ba647fe7bbd3c8f0774c831d9c38fa755b35e1
-
SSDEEP
3072:v/QPFX1eqEfuBNSYuiM8CNj8hFsoMX0ghsJRgCD3iFw9jdUA50Z:v/MEfuN0t8C5oFsoeRM3o0jG
Score3/10 -