General
-
Target
ae3628807123001020cec22c5e49c244723ed85d170059eae2baff41b06f69a0
-
Size
8.3MB
-
Sample
231225-klzz7adgg6
-
MD5
1932a651a91e51d94842191eb2b44b45
-
SHA1
89a29608c02f5db99b6f06f3eadddbc81528d7e6
-
SHA256
ae3628807123001020cec22c5e49c244723ed85d170059eae2baff41b06f69a0
-
SHA512
c8c1fdbf09f4bb03a702036f2576d06363111eb5d5bbbb57eb728c82124f7540af3906185bf1969f3867d752a2bd287966d3cbabe0dfc33709ef201c84ea4d25
-
SSDEEP
196608:W5aRduPJqTefzs/ox0gj/HPn3s3WpzRVAnk+Tm:W5aRduPcKfzXqgDf8W5RVAk+y
Static task
static1
Behavioral task
behavioral1
Sample
WTSAPI32.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
WTSAPI32.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
music.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
music.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
cobaltstrike
100000
http://www.hikunpeng.com:80/audiencemanager.js
-
access_type
512
-
host
www.hikunpeng.com,/audiencemanager.js
-
http_header1
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAABAAAAAaSG9zdDogc3RhdGljLm1pY3Jvc29mdC5jb20AAAAKAAAAJlJlZmVyZXI6IGh0dHBzOi8vc3RhdGljLm1pY3Jvc29mdC5jb20vAAAACgAAAB5BY2NlcHQtRW5jb2Rpbmc6IGd6aXAsIGRlZmxhdGUAAAAHAAAAAAAAAA0AAAACAAAACF9fbXMtY3Y9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAABAAAAAVSG9zdDogY2RuLmJvb3Rjc3MuY29tAAAACgAAACBSZWZlcmVyOiBodHRwOi8vY2RuLmJvb3Rjc3MuY29tLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAANAAAABQAAAAdfX21zLWN2AAAABwAAAAEAAAANAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
9472
-
polling_time
30000
-
port_number
80
-
sc_process32
%windir%\syswow64\runonce.exe
-
sc_process64
%windir%\sysnative\runonce.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCJKQv1XF4Cmh2xywEarCa/bP0HPP+UFEQJHMOo5NsyVYvAVfHd59D4LmvVhtB6dvdqdkLUunc6NQljbO4D42xMOrFI41rqlbFibjEJQYX58RbZvjS1bhHVKa9XdQIQRpuk3eWO4Pk+iGyM1gHKjyZT+PV5lhUp1aBwAUirc7UnEQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
1.435374848e+09
-
unknown2
AAAABAAAAAEAAAf+AAAAAgAAIUwAAAACAAAPtQAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/audiencemanager-v2.js
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4044.62 Safari/537.36
-
watermark
100000
Targets
-
-
Target
WTSAPI32.dll
-
Size
8.0MB
-
MD5
7a9e478bf4d43c7309d96fdf38540253
-
SHA1
6bead65046981723e9ec72fd138d0c7faaaf1274
-
SHA256
00c5d6b5b0db475d6f20348fd700e1a43b4b621e810d058c3bdd867a41bf305f
-
SHA512
26e971984d6ebf7f3f44554bf064f83c4fdb108a4ab574030ea82872eb8c7dcc5ce9dde43e649fe47bfa337cf71a8910ea5364df38a70deb29460dc6f810469e
-
SSDEEP
196608:Pq5qW0XniFiVJuGmPsFfjNjjREphF7BUwdY43RJr:igW0XioVJ7mPSBJELF7BUyLh
Score1/10 -
-
-
Target
music.exe
-
Size
1.4MB
-
MD5
57c3a0543085a646c010beaabf16d0be
-
SHA1
b8c0951241dc0e55c4bd73c5e2d33242bd683ff2
-
SHA256
14436eaf182648ab89c9a54d2e83e5071c07c250e6c744a314035f9424a9106f
-
SHA512
35e7b74ff0d07e1d392b6a88a3f4dfc2e1b2d77e8a9246621ad8bf15e41b8c4434a75bcf22d692e24f5450ce38b0440a7ccd749cc9d123a95487ce89cab298e8
-
SSDEEP
12288:mKg1wFSd2zIucT9v+8CbdEujvqzVoZTZINv/GPwVOPc+62z77ei8M/TW0n/T+QN1:mISYzIuw90GkT6Nv/GPwVOE+6Gei8U
Score10/10 -