Overview

overview

10

Static

static

10

Resubmissions

13/02/2024, 17:33

240213-v48p6aea21 10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2316-49-0x0000000007870000-0x00000000078A4000-memory.dmp

  • Size

    208KB

  • MD5

    76c0287ca8eb8f198c532c3ca857b3ac

  • SHA1

    d2851574943cab08a3a0903f985670fab0c7dcee

  • SHA256

    c2ea3689ffa203d8e29b24c9e43874a65cc4e4ab0e2681200479f92b9bd3d319

  • SHA512

    623363e7606b765e3aa9bd011e90a1eef5f983002bf11276ec71fc864033cef051e26da08a96e058ee0f411f4f37f609a3af408e174aa730709994335e56a285

  • SSDEEP

    3072:JdFna2JSkcrnYSdM50RAXSPy0qUiS0Lxh5H4evyzUhjQUo8iA:VRYkcrY4MCIt07iPlvU0j08

Score
10/10
666cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

666

C2

http://horseridinghotel.com:443/wp-content/chunky/

Attributes
  • access_type

    512

  • beacon_type

    2048

  • dns_idle

    6.7372036e+07

  • dns_sleep

    8.1297408e+08

  • host

    horseridinghotel.com,/wp-content/chunky/

  • http_header1

    AAAACgAAAF1BY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LGltYWdlL2F2aWYsaW1hZ2Uvd2VicCwqLyo7cT0wLjgAAAAKAAAAH0FjY2VwdC1MYW5ndWFnZTogZW4tVVMsZW47cT0wLjUAAAAKAAAAIkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZSwgYnIAAAAKAAAAFkNvbm5lY3Rpb246IGtlZXAtYWxpdmUAAAAHAAAAAAAAAA8AAAANAAAAAQAAAAkvc291cC5naWYAAAAMAAAAAAAAAA==

  • http_header2

    AAAACgAAAB5Db250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL2pzb24AAAAKAAAAEUNvbm5lY3Rpb246IGNsb3NlAAAABwAAAAAAAAAPAAAACAAAAAYAAAAOQXV0aGVudGljYXRpb24AAAAHAAAAAQAAAAMAAAACAAAATXsiaW1hZ2VfdXJsIiA6ICJodHRwOi8vbWVtZXNtaXgubmV0L21lZGlhL2NyZWF0ZWQvam9vd2RqLmpwZyIsICJhdXRoZGF0YSIgOiAiAAAAAQAAAAIifQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    7680

  • maxdns

    235

  • polling_time

    60000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\dfrgui.exe

  • sc_process64

    %windir%\sysnative\dfrgui.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCN7HPm6d02dd7700fIwQ5vU0ALDDJH/b7dbCND/stqGlKqv02PEMMqBKH8o/Qi7sVb+cMLHp6SvdEU3mJAArOujuSBQrtE7xlP7C+kKn91HpzTCWfNz+d67HvvE1RIY16FHqqXvzHiF1E5Hf9vjlnv8YfzMCWS31a0VcSjtsiAgwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    3.154317312e+09

  • unknown2

    AAAABAAAAAIAAAAwAAAAAgAAADAAAAACAAAAMAAAAAIAAAAwAAAAAgAAADAAAAACAAAAMAAAAAIAAAAwAAAAAgAAADAAAAACAAAAMAAAAAIAAAAwAAAAAgAAADAAAAACAAAAMAAAAAIAAAAwAAAAAgAAADAAAAACAAAAMAAAAAIAAAAwAAAAAgAAADAAAAACAAAAMAAAAAIAAAAwAAAAAgAAACwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /upload_image/

  • user_agent

    Mozilla/5.0 (X11; CrOS x86_64 13597.94.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.186 Safari/537.36

  • watermark

    666

Signatures

Files

  • 2316-49-0x0000000007870000-0x00000000078A4000-memory.dmp