General
-
Target
2aefa84084905e47530d26f7b43299b6d5c8cb5bdda462b631e6aa8a7c9d503e
-
Size
2.6MB
-
Sample
231121-nmtrcaeb42
-
MD5
e330933fca402e435b9f2be2c9d96b92
-
SHA1
847d50eb42dc88633704edc59e7c7e89909b1ee2
-
SHA256
2aefa84084905e47530d26f7b43299b6d5c8cb5bdda462b631e6aa8a7c9d503e
-
SHA512
e570ec04b79cad1e2672263f15b7caf1c6a8c32680666419578e1ba73769db61c5f2c182969376b1f47dc198c48c7196985d8f28c9d5b9810733cd3691015194
-
SSDEEP
49152:lg819itGDrJh+NsTWJBOBzWHvYLlGapW/giA/gD1:cuRT9oHvElGaB
Static task
static1
Behavioral task
behavioral1
Sample
2aefa84084905e47530d26f7b43299b6d5c8cb5bdda462b631e6aa8a7c9d503e.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
2aefa84084905e47530d26f7b43299b6d5c8cb5bdda462b631e6aa8a7c9d503e.exe
Resource
win10v2004-20231023-en
Malware Config
Extracted
cobaltstrike
1234567890
http://47.120.48.10:80/pixel
-
access_type
512
-
host
47.120.48.10,/pixel
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
80
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMM//+PRROW9ZoGarkselMZllrkMN3w+HY01/AHtGQIw68cmglWc+FQ77ZHvbS2XsDKI4vWFmTYnyuZ/F4Svq+ssCGPCm2ukkMQDvwAw6IXof25fVuo4mpBimXB9J0buiPqhyuC1/QMqG8pJwAVbO7hTv6CSgybu8DwzPIAZ0kCwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)
-
watermark
1234567890
Extracted
cobaltstrike
0
-
watermark
0
Targets
-
-
Target
2aefa84084905e47530d26f7b43299b6d5c8cb5bdda462b631e6aa8a7c9d503e
-
Size
2.6MB
-
MD5
e330933fca402e435b9f2be2c9d96b92
-
SHA1
847d50eb42dc88633704edc59e7c7e89909b1ee2
-
SHA256
2aefa84084905e47530d26f7b43299b6d5c8cb5bdda462b631e6aa8a7c9d503e
-
SHA512
e570ec04b79cad1e2672263f15b7caf1c6a8c32680666419578e1ba73769db61c5f2c182969376b1f47dc198c48c7196985d8f28c9d5b9810733cd3691015194
-
SSDEEP
49152:lg819itGDrJh+NsTWJBOBzWHvYLlGapW/giA/gD1:cuRT9oHvElGaB
Score10/10 -