General
-
Target
5e9b0106d628229cdd7504bd01c76ccf6bb57a80def3e9be4d0fa15aaf5f36e2
-
Size
2.6MB
-
Sample
240112-tlrs9abhf8
-
MD5
6a218d06e9256a5fa399a5f4c56e9d7b
-
SHA1
2560b13274ea722cc79ceeef93adf57d4f4641fe
-
SHA256
5e9b0106d628229cdd7504bd01c76ccf6bb57a80def3e9be4d0fa15aaf5f36e2
-
SHA512
2a2a98608f5d29cec80f17c4aff56ee8ef54472413d587d9c6b39d025f975999e4566a880d2be8e5798176d3e1864d9d423f04e9355bdb047cfe17095a298a62
-
SSDEEP
49152:EGrf2fZudRq44d3iUgiAmm+gGXS1WLKD1:Bm44gUgirbS
Static task
static1
Behavioral task
behavioral1
Sample
5e9b0106d628229cdd7504bd01c76ccf6bb57a80def3e9be4d0fa15aaf5f36e2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5e9b0106d628229cdd7504bd01c76ccf6bb57a80def3e9be4d0fa15aaf5f36e2.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
cobaltstrike
1359593325
http://101.43.164.28:8082/owa/
-
access_type
512
-
host
101.43.164.28,/owa/
-
http_header1
AAAAEAAAABZIb3N0OiBvdXRsb29rLmxpdmUuY29tAAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAACGQ29va2llOiBNaWNyb3NvZnRBcHBsaWNhdGlvbnNUZWxlbWV0cnlEZXZpY2VJZD05NWMxOGQ4LTRkY2U5ODU0O0NsaWVudElkPTFDMEY2QzVEOTEwRjk7TVNQQXV0aD0zRWtBakRLakk7eGlkPTczMGJmNzt3bGE0Mj1aRzB5TXpBMktqRXMAAAAHAAAAAAAAAA0AAAAFAAAAAndhAAAACQAAAA5wYXRoPS9jYWxlbmRhcgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAAEAAAABZIb3N0OiBvdXRsb29rLmxpdmUuY29tAAAACgAAAAtBY2NlcHQ6ICovKgAAAAcAAAABAAAADQAAAAUAAAACd2EAAAAHAAAAAAAAAA0AAAACAAAABndsYTQyPQAAAAIAAAALeGlkPTczMGJmNzsAAAACAAAAEk1TUEF1dGg9M0VrQWpES2pJOwAAAAIAAAAXQ2xpZW50SWQ9MUMwRjZDNUQ5MTBGOTsAAAACAAAAOE1pY3Jvc29mdEFwcGxpY2F0aW9uc1RlbGVtZXRyeURldmljZUlkPTk1YzE4ZDgtNGRjZTk4NTQ7AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
GET
-
jitter
5120
-
polling_time
5000
-
port_number
8082
-
sc_process32
%windir%\syswow64\gpupdate.exe
-
sc_process64
%windir%\sysnative\gpupdate.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCaS3U3/pImLVYtk2PpanYkY3ZSvSpT29MZ+RsWo77hYYlZ7VfC/wSwRqr7GW0+jzew6B6oQVXOTDrKguViAfoac8788JalXE26XwQ6HfSQQ27+x+i+GTS0O+7pxy5bVYS8xqIFjhH4FpXoTRqRqMEatPZewurRo0BVEmeDSeBSPwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
1.448416512e+09
-
unknown2
AAAABAAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown3
1.610612736e+09
-
uri
/OWA/
-
user_agent
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko)
-
watermark
1359593325
Extracted
cobaltstrike
0
-
watermark
0
Targets
-
-
Target
5e9b0106d628229cdd7504bd01c76ccf6bb57a80def3e9be4d0fa15aaf5f36e2
-
Size
2.6MB
-
MD5
6a218d06e9256a5fa399a5f4c56e9d7b
-
SHA1
2560b13274ea722cc79ceeef93adf57d4f4641fe
-
SHA256
5e9b0106d628229cdd7504bd01c76ccf6bb57a80def3e9be4d0fa15aaf5f36e2
-
SHA512
2a2a98608f5d29cec80f17c4aff56ee8ef54472413d587d9c6b39d025f975999e4566a880d2be8e5798176d3e1864d9d423f04e9355bdb047cfe17095a298a62
-
SSDEEP
49152:EGrf2fZudRq44d3iUgiAmm+gGXS1WLKD1:Bm44gUgirbS
Score10/10 -