Overview

overview

10

Static

static

10

0d7d4dc173...76.exe

windows10-1703-x64

1

260ebbf392...5b.exe

windows10-1703-x64

1

2779937398...92.dll

windows10-1703-x64

1

740992d40b...48.dll

windows10-1703-x64

1

75b30164a3...72.exe

windows10-1703-x64

1

9ccb4ed133...e5.exe

windows10-1703-x64

1

9d4b4c3910...99.exe

windows10-1703-x64

9

b7f36159ae...0b.exe

windows10-1703-x64

9

cf4bf26b2d...8a.exe

windows10-1703-x64

1

cf65cc6e4b...1b.exe

windows10-1703-x64

3

d0dd9c624b...d9.exe

windows10-1703-x64

1

d2642d3731...22.exe

windows10-1703-x64

10

db36ad7787...0d.exe

windows10-1703-x64

1

e784e95fb5...43.exe

windows10-1703-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    WinX.OperationDianxun.zip

  • Size

    3.2MB

  • MD5

    5151bba22faaa41af6b96287c82b3351

  • SHA1

    a9bd15eb42f12a8592f048255af7433cdc5340b5

  • SHA256

    f353353f5f7f7551088cdda2f58ae9ff6aaa923b3a238f2426e1ccdf4a3ae1b4

  • SHA512

    bdcacf9bd402d9dbf9c27c515ee49358c59132aa58b319606f50205c00f8c01437082c0f2655c27101f75b4772ea0e8433d49645abad0f89d7261e850c17cfe8

  • SSDEEP

    98304:X6u0mmxKPkIrE99UhWQohq3xjmBChfq06Aa/:X692YqhW9qzqn/

Score
10/10
305419896cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

305419896

C2

http://update1.jscachecdn.com:443/s/ref=nb_sb_noss_1/264-84198498-9827145/field-keywords=woman

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    update1.jscachecdn.com,/s/ref=nb_sb_noss_1/264-84198498-9827145/field-keywords=woman

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAABAAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy1aS2ZWTnJUdUpQMDlFRzlGeno5SXwyMDgzMTUyMTM0MzE1AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAQAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz04OTY3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    3584

  • maxdns

    245

  • polling_time

    6800

  • port_number

    443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrylu1nawNqTnchDFZwhM5rPX9/kaphE5BDrR8bk5ALmoLJi/2cEd9JZrC2SYYnb5T77fX3x626TxdJ5G+/97opftYZbdE8iL2E3+TfmbpIPQ1euTNHG80msizEFGH4FHkFaTQNi0LQKy3bAotTH3bB6Tyl68jiQUZGDqIrK4J0QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /N9185/adj/amzn.us.sr.aps

  • user_agent

    Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

  • watermark

    305419896

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Unsigned PE 13 IoCs

    Checks for missing Authenticode signature.

Files

  • WinX.OperationDianxun.zip
    .zip

    Password: infected

  • 0d7d4dc173c88c4f72c8f9f419ae8473d044f4b3e8f32e4a0f34fe4bbc698776
    .exe windows:4 windows x86 arch:x86

    Password: infected

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 260ebbf392498d00d767a5c5ba695e1a124057c1c01fff2ae76db7853fe4255b
    .exe windows:6 windows x64 arch:x64

    Password: infected

    fa131ae3f0b2aecd572c532c89cf6976


    Headers

    Imports

    Sections

  • 2779937398506e8ad207f5b291ae53d8af82b9f2739b0508ae3e0cfc40ced092
    .dll windows:6 windows x64 arch:x64

    Password: infected

    0f275d628096389203c13780013332e4


    Headers

    Imports

    Exports

    Sections

  • 740992d40b84b10aa9640214a4a490e989ea7b869cea27dbbdef544bb33b1048
    .dll windows:6 windows x64 arch:x64

    Password: infected

    afced76612f55d0f0fbaa98a6e0ec144


    Headers

    Imports

    Exports

    Sections

  • 75b30164a31d305f47f2c3c2121432e6d7b316cfb3deb6b39f78180168bc9472
    .exe windows:6 windows x64 arch:x64

    Password: infected

    0bcdf8cb02b1ea5928789faf16f42f6f


    Headers

    Imports

    Sections

  • 9ccb4ed133be5c9c554027347ad8b722f0b4c3f14bfd947edfe75a015bf085e5
    .exe windows:6 windows x64 arch:x64

    Password: infected

    5f7ca61a772049e7c494c6c74d69484c


    Headers

    Imports

    Sections

  • 9d4b4c39106f8e2fd036e798fc67bbd7b98284121724c0f845bca0a6d2ae3999
    .exe windows:6 windows x64 arch:x64

    Password: infected

    6f40c4c8bf0dd224f80339a8e10ba2e1


    Headers

    Imports

    Sections

  • b7f36159aec7f3512e00bfa8aa189cbb97f9cc4752a635bc272c7a5ac1710e0b
    .exe windows:6 windows x64 arch:x64

    Password: infected

    6314b882e0fe3c722488db14d97812d6


    Headers

    Imports

    Sections

  • cf4bf26b2d6f1c6055534bbe9decb579ef0180e0f8c467c1a26e2ead7567058a
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • cf65cc6e4b2b0c3f602b16398c8c30c277b8cfaed689fe7cb61b92560d4e5b1b
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • d0dd9c624bb2b33de96c29b0ccb5aa5b43ce83a54e2842f1643247811487f8d9
    .exe windows:6 windows x64 arch:x64

    faaa332605e536ebdebf6a0f58e1b286


    Code Sign

    Headers

    Imports

    Sections

  • d2642d3731508b52efa34adf57701f18e2f8b70addf31e33e445e75b9a909822
    .exe windows:4 windows x86 arch:x86

    829da329ce140d873b4a8bde2cbfaa7e


    Headers

    Imports

    Sections

  • db36ad77875bbf622d96ae8086f44924c37034dd95e9eb6d6369cc6accd2a40d
    .exe windows:6 windows x64 arch:x64

    3baa9e2a3313377196f4864fb04c6780


    Headers

    Imports

    Sections

  • e784e95fb5b0188f0c7c82add9a3c89c5bc379eaf356a4d3876d9493a986e343
    .exe windows:6 windows x64 arch:x64

    a2299d0f3dc7ceb58a9cb48d7495fffb


    Headers

    Imports

    Sections