General
-
Target
41eb24d16ded391c973e9dbc6c2fec00
-
Size
220KB
-
Sample
240104-zzdrfabffk
-
MD5
41eb24d16ded391c973e9dbc6c2fec00
-
SHA1
f80bdff323b4e90a3b58442c92b406ccaf7baeeb
-
SHA256
de9276fe0d69980d3ab80be2883bef46bd5979234ada3b221c4f415103b6cc71
-
SHA512
7739552705e09657fe120ff24e3f8abdf3ff88c266ff072debf7db4cddecdc71033733e85bafaef728ce4948fc4cf8ea191ccf139465500090ff3f8bce84fa11
-
SSDEEP
3072:rFHJbdxOK3Ye0BQE75pG7Pw16v2tHQAB/YgSCc4YRT4EDjm0sLWq15HSKQgO:p9b3Ye0WWnfoUTbc4s4EDCPWq1RSKQ
Behavioral task
behavioral1
Sample
41eb24d16ded391c973e9dbc6c2fec00.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
41eb24d16ded391c973e9dbc6c2fec00.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
cobaltstrike
426352781
http://168.100.10.71:80/cm
-
access_type
512
-
host
168.100.10.71,/cm
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
80
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQChLHP0fqPwY26Ur24EuOALaEpwv9Ra9ZYmkEnIo/wv6Um7KHAJdZP4RSaxNsYlX/tYhZScXgvdNbuNv3VSMVxV+ByWTvg7hAcQ6g7u0SrvRNGiITiIVCtQ5Ig5D0aEwyjMPFYmseQMMQ/fu3u3LQLfCdNxmfVcr3Rwbhp8JT08/wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
-
watermark
426352781
Targets
-
-
Target
41eb24d16ded391c973e9dbc6c2fec00
-
Size
220KB
-
MD5
41eb24d16ded391c973e9dbc6c2fec00
-
SHA1
f80bdff323b4e90a3b58442c92b406ccaf7baeeb
-
SHA256
de9276fe0d69980d3ab80be2883bef46bd5979234ada3b221c4f415103b6cc71
-
SHA512
7739552705e09657fe120ff24e3f8abdf3ff88c266ff072debf7db4cddecdc71033733e85bafaef728ce4948fc4cf8ea191ccf139465500090ff3f8bce84fa11
-
SSDEEP
3072:rFHJbdxOK3Ye0BQE75pG7Pw16v2tHQAB/YgSCc4YRT4EDjm0sLWq15HSKQgO:p9b3Ye0WWnfoUTbc4s4EDCPWq1RSKQ
Score10/10 -