General
-
Target
8a1417ad28c29bb2c642b959876420a8228ac530fc9c6b61094f0cf6c7627061
-
Size
546KB
-
Sample
231214-cck6nsagdp
-
MD5
55f71811f723fad949c12c93332e0a2c
-
SHA1
a09b915813bda26528cc74a192e30b3929dd875f
-
SHA256
8a1417ad28c29bb2c642b959876420a8228ac530fc9c6b61094f0cf6c7627061
-
SHA512
86d2ebdf501309533bb774eecadbd02fd6c5f73a14b7a463cc93b3ab347d87c408f13aea7ad54c214307d74cee157aedbb8be38d85554533050aacc2cbbe8d0c
-
SSDEEP
6144:WG+h2udpWIpFv5bRLTO+66KEswlQrqXMmAmS+LKnkH2RuT2WKVuOiElHyJivdmoB:rD+Prv5FfQrI6BkWIKxurw0Bsd9
Malware Config
Extracted
cobaltstrike
1359593325
http://34.32.0.249:443/jscroll/board/list.jpg
-
access_type
512
-
beacon_type
2048
-
host
34.32.0.249,/jscroll/board/list.jpg
-
http_header1
AAAAEAAAABZIb3N0OiB3d3cuZXllLXdhdGNoLmluAAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAeQ29va2llOiAwNDQ5NjUxMDAzZmU0OC1OZmYwZWI3AAAACQAAAAthY3Rpb249V2hhdAAAAAcAAAAAAAAACAAAAAUAAAABdQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAAEAAAABZIb3N0OiB3d3cuZXllLXdhdGNoLmluAAAACgAAAAtBY2NlcHQ6ICovKgAAAAkAAAAPYWN0aW9uPUJhc2VJbmZvAAAABwAAAAEAAAAIAAAABQAAAAF1AAAACQAAAAhlcnI9a2lsbAAAAAcAAAAAAAAADQAAAAIAAAAPMDQ0OTY1MTAwM2ZlNDgtAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
GET
-
jitter
5120
-
polling_time
30000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCMwuocfWgnoTHTJZP5GNeltlFx7fOaWdt9i8Ko3AlY0eHdNx02E6vHNrAxBVbDvBAlW8IuzUrsiRlzq3UmAqdtrsskXremk8j3AB73Xch2j2zp9uM+KiE2+ZMH//aApC6Mxp8lME9nRTolGOwveUBCESsFNyqtr1sp/0xw2rNb8QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
8192
-
unknown2
AAAABAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown3
1.610612736e+09
-
uri
/jscroll/board/List.jpg
-
user_agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
-
watermark
1359593325
Targets
-
-
Target
8a1417ad28c29bb2c642b959876420a8228ac530fc9c6b61094f0cf6c7627061
-
Size
546KB
-
MD5
55f71811f723fad949c12c93332e0a2c
-
SHA1
a09b915813bda26528cc74a192e30b3929dd875f
-
SHA256
8a1417ad28c29bb2c642b959876420a8228ac530fc9c6b61094f0cf6c7627061
-
SHA512
86d2ebdf501309533bb774eecadbd02fd6c5f73a14b7a463cc93b3ab347d87c408f13aea7ad54c214307d74cee157aedbb8be38d85554533050aacc2cbbe8d0c
-
SSDEEP
6144:WG+h2udpWIpFv5bRLTO+66KEswlQrqXMmAmS+LKnkH2RuT2WKVuOiElHyJivdmoB:rD+Prv5FfQrI6BkWIKxurw0Bsd9
Score10/10-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-