General
-
Target
256eead542a5d5a1c8d73b5c9054363bcbeb7d04d3050146dbcfbbbef04ac1e2
-
Size
208KB
-
Sample
240123-psjc8sahe7
-
MD5
a08d332b25bde5a088efbc4c1afa096d
-
SHA1
b1dbec2fd683acc9f906d61c1f728b439cae5a95
-
SHA256
256eead542a5d5a1c8d73b5c9054363bcbeb7d04d3050146dbcfbbbef04ac1e2
-
SHA512
41c135cbfe861cbe4ec4b3f4e0cb657c98056497160dadffcaf5ec6cb74f594068024f9130b2382040061ee6b2ad99aa2326fad0eee2038f77aabaf922120978
-
SSDEEP
6144:9443XR4S38CnBeBxi66thkbAzLks1YarGR8ej4rC5Jj9:JM2MBIz+YLks1YarGR8PWj9
Behavioral task
behavioral1
Sample
256eead542a5d5a1c8d73b5c9054363bcbeb7d04d3050146dbcfbbbef04ac1e2.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
256eead542a5d5a1c8d73b5c9054363bcbeb7d04d3050146dbcfbbbef04ac1e2.dll
Resource
win10v2004-20231215-en
Malware Config
Extracted
cobaltstrike
100000
http://45.154.24.14:443/maps/overlaybfpr
-
access_type
512
-
beacon_type
2048
-
host
45.154.24.14,/maps/overlaybfpr
-
http_header1
AAAAEAAAABJIb3N0OiB3d3cuYmluZy5jb20AAAAKAAAAC0FjY2VwdDogKi8qAAAACgAAAB9BY2NlcHQtTGFuZ3VhZ2U6IGVuLVVTLGVuO3E9MC41AAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAAAAAAAAwAAAAIAAAAEX1NTPQAAAAIAAAAQU1JDSEQ9QUY9Tk9GT1JNOwAAAAYAAAAGQ29va2llAAAACQAAABhxPXNhbiUyMGRpZWdvJTIwY2ElMjB6b28AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAAEAAAABJIb3N0OiB3d3cuYmluZy5jb20AAAAKAAAAC0FjY2VwdDogKi8qAAAACgAAABZBY2NlcHQtTGFuZ3VhZ2U6IGVuLVVTAAAACgAAABZDb250ZW50LVR5cGU6IHRleHQveG1sAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAABAAAADQAAAAIAAAAIU1JDSFVJRD0AAAACAAAAEFNSQ0hEPUFGPU5PRk9STTsAAAAGAAAABkNvb2tpZQAAAAcAAAAAAAAADQAAAAUAAAADbGlkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
9728
-
polling_time
62000
-
port_number
443
-
sc_process32
%windir%\syswow64\gpupdate.exe
-
sc_process64
%windir%\sysnative\gpupdate.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtt5H+QbfH4ILEXg12PomEjuPjLgia+NacQFGHt2Lq2nkS041VyMAViMZ0P8D9tt6nYfHOEzmpgMuf4F4PxJoivDdpjraN5Vkf3r8w4n6Q+oDp/AuCfn+4W572qUq/ibD3HruUMK/FZ0aYiX/2WqdnxEcq9IGIHYXKKFop7hfstwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
3.646887168e+09
-
unknown2
AAAABAAAAAEAAAiUAAAAAgAAAe0AAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown3
1.610612736e+09
-
uri
/fd/ls/lsp.aspx
-
user_agent
Mozilla/5.0 (compatible; mobile! telephone; https://mobile.bing.com/search)
-
watermark
100000
Targets
-
-
Target
256eead542a5d5a1c8d73b5c9054363bcbeb7d04d3050146dbcfbbbef04ac1e2
-
Size
208KB
-
MD5
a08d332b25bde5a088efbc4c1afa096d
-
SHA1
b1dbec2fd683acc9f906d61c1f728b439cae5a95
-
SHA256
256eead542a5d5a1c8d73b5c9054363bcbeb7d04d3050146dbcfbbbef04ac1e2
-
SHA512
41c135cbfe861cbe4ec4b3f4e0cb657c98056497160dadffcaf5ec6cb74f594068024f9130b2382040061ee6b2ad99aa2326fad0eee2038f77aabaf922120978
-
SSDEEP
6144:9443XR4S38CnBeBxi66thkbAzLks1YarGR8ej4rC5Jj9:JM2MBIz+YLks1YarGR8PWj9
Score1/10 -